v0.2.0

luau-shield v0.2.0: far fewer false positives on real games, with no lost detections.

Tested on a real Roblox game (144 files): all 5 v0.1.0 findings were false positives, and v0.2.0 reports none.

What changed

• Dynamic keys: for key, value in patch do changed[key] = value end is now tracked field by field, so one untrusted field no longer taints the whole table
• Admin guards: code after isAdmin/hasPermission checks on the sender is reported as info ("admin only"), hidden by default. Guard names are configurable in [guards]. Inline checks (creator id, high group rank, staff role, server-side admin lists) are recognized too
• Validators that build a new value (like a sanitize that clamps each field) are recognized automatically through function summaries, even beyond max-call-depth. When that's not possible, the finding suggests declaring them in [[sanitizers]]
• Rate limits (luau-shield007): state-machine guards now count as a limit, and work inside a condition is reported as "when a condition holds" instead of "on every request"
• %d patterns now exclude NaN
• Faster on large projects (5.7 s → 3.8 s on the largest generated project)

Accuracy

Test corpus grown to 227 vulnerable and 161 safe cases: 292/292 expected findings, 0 false positives, 0 false negatives. Two adversarial review rounds of the fixes found 97 issues (mostly overly permissive guards, like group rank >= 1 counting as admin), each now a regression test.

Known limits

• A guard is trusted by name: an isAdmin that always returns true is not detected
• A wait shorter than 0.1 s does not count as a rate limit
• 11 documented limitation cases (7 false positives, 5 false negatives) in tests/fixtures/limitations

MIT license.

v0.1.0

First release of luau-shield: a static security analyzer for Roblox games written in Luau.

It finds the bugs exploiters actually use: values sent by the client through remotes that reach currency, DataStores, character properties, loadstring, HTTP requests or other players' objects without being validated.

Highlights

• Real data-flow analysis, not regular expressions: follows untrusted values through variables, tables, local functions and required modules
• Understands validation: typeof checks, bounds, NaN checks, allow-lists, ownership checks, assert, your own validators and the t library
• 8 rules, from untrusted economy writes to secrets exposed to the client
• Clear findings: the code, the path of the data from the remote to the dangerous line, why it is exploitable and how to fix it
• Made for CI: text, JSON and SARIF output, exit codes, and a GitHub Action that uploads results to the Security tab
• Optional AI explanations with a local Ollama model (--explain)

Install

rokit add Topogamer0/luau-shield

Or download the binary for your system below: Windows x64, macOS (Apple Silicon and Intel), Linux x64.

Accuracy

On the test corpus (127 vulnerable and 125 safe cases): 148/148 expected findings, 0 false positives, 0 false negatives. Known limitations are documented in the README.

MIT license.