Roblox Luau Developer

Workflow

1. First identify the project type:
   • Rojo project: Look for

     default.project.json

     ,

     *.project.json

     ,

     sourcemap.json

     .
   • Package management: Look for

     wally.toml

     ,

     aftman.toml

     ,

     .luaurc

     ,

     selene.toml

     ,

     .stylua.toml

     .
   • Studio export: Identify directories like

     .rbxlx

     ,

     .rbxmx

     ,

     .model.json

     ,

     src/

     ,

     ReplicatedStorage/

     ,

     ServerScriptService/

     .
2. Read existing code and naming conventions before making changes:
   • Use

     rg

     to search for services, modules, Remote names, Attribute names, CollectionService Tags.
   • Clarify the call directions of ServerScript, LocalScript, and ModuleScript.
   • Do not invent Instance paths, Remote names, or UI control names out of thin air.
3. Maintain Roblox layering during implementation:
   • Authoritative state and validation are on the server side.
   • The client is only responsible for input, display, prediction, and requests.
   • Remote parameters must undergo type and permission validation.
   • DataStore writes require throttling, retries, and failure handling.
4. Prioritize small changes:
   • Maintain the existing Module return format, service names, and require methods.
   • Avoid implicit global states in public modules.
   • Provide cleanup paths for shared tables and connection objects.
5. Validation:
   • If there are

     selene

     ,

     stylua

     ,

     luau-lsp

     ,

     lune

     ,

     rojo

     or project scripts, run existing checks first.
   • If only static checks are possible, clearly state that no Studio/Play Solo runtime validation was performed.

Common Risks

• The client directly trusts high-value requests such as currency, inventory, damage, and teleportation.
• RemoteEvent lacks rate limiting or permission checks.
• Frequent creation of Instances, event connections, or expensive queries in loops.

• Touched

  ,

  Heartbeat

  ,

  RenderStepped

  are not disconnected.
• DataStore has no fallback save when players leave or the server shuts down.
• UI scripts and server logic require each other, leading to runtime environment errors.

Output Format

• Changes: Describe which scripts and behaviors were modified.
• Server/Client Boundary: Indicate which side holds the authoritative logic.
• Remote/DataStore Risks: List risks of newly added or modified interfaces.
• Validation: List the checks actually performed; clearly state if Studio runtime validation was not possible.