Privacy and security

What crosses the relay#

Everything the interface shows: remote calls and their arguments, HTTP requests and responses, instance names and properties, script sources, console output. That is the data you asked to see, captured on your machine and displayed in your browser.

It crosses over TLS (wss://), so it is encrypted in transit. TLS ends at the relay, which means the relay handles frames in plaintext: it could read them. They are not end-to-end encrypted between your game and your browser. What the relay cannot do is forge a command: commands are signed with a session key the relay never receives (see below).

What the relay stores#

Nothing.

Frames are forwarded byte for byte. The relay does not parse them. Many are LZ4-compressed and base64'd, and reading one would mean decompressing it first.

The only state it holds is, per live session:

• the room code
• which sockets belong to it
• when they last spoke, so dead ones can be swept

There is no database. Frame contents are never logged and never written to disk. Room codes are not logged either: log lines name a room by a short hash of its code. A room with nobody in it is deleted a minute later.

What your browser stores#

Two kinds of data, held differently on purpose.

Captured game data stays in memory, in this tab. Remote calls, web traffic, console output, the Explorer's structure and decompiled sources are all derived from the game you are attached to. Close the tab and they are gone; reattach and the game produces them again. Nothing captured is written to disk.

Your own work persists. Editor files, the Roblox API data behind autocomplete, the room code, its session key, your permission switches and interface settings are saved in this browser and survive a reload.

That means:

• Closing the tab clears every capture
• Your editor files and room code stay until you delete them
• Your editor files and settings are not uploaded, and there is no account. Captured game data crosses the relay on its way to this tab, as described above, and is not stored there

Who can see a session, and who can control it#

Watching takes the room code. Anyone with it can join your room and see the same traffic.

Controlling takes the session key as well. The key is made in your browser and reaches the game only as the argument of the loadstring you run, so it is in no URL and never passes through rbx.lol's servers. Every command carries an HMAC-SHA256 signature under that key, over the game connection's nonce and a sequence number, and the client refuses anything that does not verify: an unsigned command, a wrong key, a replay, or a command signed for an earlier connection. It also refuses commands of the wrong shape or size, and more than a set number a second.

A room holds one game and any number of browser tabs, so the debugger and the RBX Editor can share one room code. A second executor joining the room replaces the first, and the replaced client is told so and stops reconnecting. To share control with someone, give them CODE:KEY (the key is the last part of the loadstring); the code alone lets them watch.

What we can see#

Operationally: how many rooms are open, and that a socket connected. That is what the health endpoint reports and what the process logs.

We do not record your room's contents, your game, your account, or anything inside a frame. As above, the relay could technically read frames as they pass; it is built not to. The relay's source is not published, so that part is our word rather than something you can check.

What you can check is everything that runs in your game. The client is served as readable source at /netbridge/source, with the helper scripts the page sends it listed at the top of that file. The copy your loadstring downloads is the same file with one line changed: the relay address with your room code in it.

Running it yourself#

The client dials whatever getgenv().NETBRIDGE_URL says, ahead of the address the hosted build writes into it. Point it at your own bridge:

getgenv().NETBRIDGE_URL = "ws://localhost:9000/"
loadstring(game:HttpGet("https://rbx.lol/netbridge/client.lua?room=ABCD234XYZ"))("<session key>")

The room code still has to be in the link, because the server refuses to serve a client without one. Nothing else touches the network beyond your own machine.

The caveats#

• Your executor sees everything anyway. RBX Debugger does not grant access it did not already have. It displays it.
• A relay operator could log frames. This one is built not to, but its source is not published, so you are taking that on trust. Frames are not end-to-end encrypted, so do not capture anything through the hosted relay that you would not want its operator able to see. The operator could not send your game commands: that takes the session key, which it never sees.
• The key is only as safe as your executor and browser. It sits in this browser's storage and in the script your executor ran.
• Roblox may consider executor use against its terms. That is between you and Roblox, and it is true of every tool in this category.