Safety and review principles
How RBLX Creator approaches third-party asset review, code inspection, file handling, and responsible creator workflows.
No blanket safety guarantees
A checklist or manual review cannot prove that a model, script, plugin, or project file is completely safe. Any review claim must state scope, date, methods, and limitations.
Inspect model contents
Review the Explorer hierarchy and identify Script, LocalScript, and ModuleScript instances. Read unfamiliar code, trace dependencies, and look for unexpected HTTP requests, obfuscated logic, hidden administrative behavior, and unusual remote events.
Review trust boundaries
Understand which logic runs on server and client. Validate client requests on the server, avoid trusting client-supplied values, and understand each RemoteEvent or RemoteFunction.
Use an isolated test project
Do not run unknown code in a live experience. Test in a separate project with no sensitive credentials or production data.
Prohibited content
Do not submit exploits, cheats, account theft tools, credential stealers, malware, hidden backdoors, anti-cheat bypasses, or exploit executors.
File handling
If submissions are enabled, use format allowlists, size limits, MIME and magic-byte checks, safe filenames, isolated storage, rate limiting, moderation, audit logs, and scanning. Never execute uploads on production servers.
Report concerns
Provide a clear contact path for suspected malicious content, broken links, or inaccurate safety claims.
Owner action required: This page is a draft template. Replace operational placeholders, confirm applicable law and business practices, and obtain professional review before launch.