Security

1. Checking scripts

Every script is checked by Scriptsight when it is uploaded and whenever it changes. Most scripts load their real code from another site, so Scriptsight follows those links and reads that code too. It checks linked code again on a schedule, because the code behind a link can change after it is published.

Scriptsight reads the code itself, has it reviewed by two separate AI models, and runs it in an isolated sandbox that behaves like Roblox and an executor, watching what it does. Automatic action needs evidence from the code or from the run, and both models to agree.

A script that steals accounts or items, or sends people to a fake Roblox site, is taken down and its uploader is banned. Scripts that do something users should know about, such as sending your username to their author, show a notice on their page. Staff review what the checks can't decide.

A Scriptsight verified badge means the checks read all of the code the script runs and found nothing harmful. A script whose code can't be read in full doesn't get one.

2. Reporting a harmful script

Use Report on the script's page. A report of malware starts a fresh check straight away, and staff review it. You can follow what happened to your reports from your reports page.

3. Account security

• Passwords are stored only as salted, slow hashes. We check new passwords against known data breaches without sending the password anywhere.
• You can turn on two-step sign-in with an authenticator app in Account settings. It applies to every way of signing in, and comes with one-time recovery codes.
• Your account settings list every device signed in to your account, and you can sign the others out.
• We email you when your email, password, two-step sign-in or linked Discord account changes.
• Sign-in attempts are rate limited, and changing your password signs out every device.
• Uploading needs a Discord account that has joined the RoScripts server.

4. Infrastructure

• RoScripts runs on Cloudflare. Data is encrypted in transit and at rest.
• Every page is served over HTTPS only, with a strict Content Security Policy.
• Both databases are backed up every night. Backups are encrypted with a key that isn't stored on our servers, and are locked so they can't be changed or deleted early.
• Payments for RoScripts Pro are handled by Stripe. We never see or store card numbers.
• The services we share data with are listed in our Privacy Policy.
• Every code change is checked for leaked secrets and vulnerable dependencies before it ships.

5. Staff access

Staff can only act after signing in with a Discord account that has two-factor authentication on. Each staff role can do only what that role needs, and every staff action is logged with who took it.

6. Privacy and deletion

We don't run ads or sell data. IP addresses are used for security and rate limiting, and are erased within 90 days. You can download your data or delete your account at any time from Account settings. The Privacy Policy has the details.

7. Reporting a vulnerability

Email [email protected] with what you found, the steps to reproduce it and what it lets someone do. We reply within 5 working days and tell you when it is fixed.

We won't take action against research done in good faith that follows these rules:

• Use only accounts you own, and stop if you reach someone else's data.
• Don't degrade the service, send spam or upload harmful scripts.
• Give us a reasonable time to fix the problem before you share it.

To report a harmful script, use Report on its page instead.