Advanced static analysis utility engineered for Roblox Studio to parse LuaSourceContainers and eradicate hardcoded credentials before deployment.
During security assessments and environment audits, a recurring vector of compromise kept surfacing: accidental credential exposure. Developers often hardcode production Discord Webhooks, administrative API keys, authentication tokens, and client secrets directly into scripts during fast-paced prototyping, forgetting to strip them out before publishing or opening team-create sessions to external contractors.
Spectre was engineered by shark7_7 to solve this exact vulnerability class. Instead of relying on manual code reviews—which are prone to human error and blind spots across thousands of hierarchical nodes—Spectre automates the discovery pipeline with enterprise-grade precision, scanning the entire DataModel instance tree in seconds.
Hardcoding secrets in client-server architectures introduces catastrophic attack surfaces:
- Discord Webhook Abuse: Attackers scrape embedded webhooks to spam malicious payloads, flood community servers, or hijack logging channels.
- API & Token Compromise: Exposed tokens grant unauthorized access to external backend systems, database endpoints, and third-party APIs.
- Privilege Escalation Vectors: Client-side scripts containing sensitive keys allow exploiters to impersonate backend systems or perform unauthorized administrative actions.
Spectre acts as an automated gatekeeper, executing deep-pattern regex scanning across every script container (Script, LocalScript, ModuleScript) to flag threats instantly.
- Zero-Configuration Speed: Instantly aggregates all nodes across
Workspace,ReplicatedStorage,ServerScriptService, and other core services with a single click. - Precise Threat Classification: Automatically categorizes violations into distinct vectors:
- 🔴 Discord Webhooks
- 🔑 API Keys
- 🎫 Access Tokens
- 🔒 Client Secrets
- Instant Navigation (
Inspect Source): Clicking a threat card automatically focuses the asset in the explorer and opens the source code directly in your script editor. - Modern Developer Experience (UI/UX): Built with custom theme elements, fluid tweens, progress tracking, and non-blocking background task scheduling (
task.spawn) to prevent studio freezing.
Spectre evaluates code against robust regular expression signatures optimized for Lua source structures:
| Threat Type | Pattern Matcher Logic |
|---|---|
| Discord Webhook | discord%.com/api/webhooks/%d+/[%w%-_]+ |
| API Key | api_key%s*=%s*['\\"][%w%-_]+['\\"] |
| Access Token | token%s*=%s*['\\"][%w%-_]+['\\"] |
| Client Secret | secret%s*=%s*['\\"][%w%-_]+['\\"] |
- Download the latest
.rbxmxor.rbxmbuild from the Releases tab. - Drop the file directly into your Roblox Studio local plugins directory:
- Windows:
%localappdata%\Roblox\Plugins - Mac:
~/Documents/Roblox/Plugins
- Windows:
- Restart Roblox Studio. The Spectre Security Suite toolbar will appear automatically.
- Clone the repository or copy the raw script contents from
main.lua. - Create a new
Scriptin yourServerScriptService. - Right-click the script and select Save as Local Plugin....
- Open Roblox Studio and load your place file.
- Navigate to the Plugins tab on the top ribbon.
- Click the Spectre Scanner icon to open the security audit widget.
- Click INITIATE SYSTEM SCAN.
- Review real-time progress as Spectre analyzes your
LuaSourceContainers. - Inspect and remediate any flagged vulnerabilities using the direct jump buttons.
Engineered with precision by shark7_7.
- GitHub: @shark-sec