← Back to OOF

Security

Last updated: February 7, 2026

Architecture

Local bridge only: The Studio plugin communicates with a bridge server bound to 127.0.0.1 (localhost).
No secrets in the plugin: The Roblox Studio plugin does not embed API keys, Stripe keys, or license private keys.
Signed keys: Paid tiers are represented as signed keys (OOF1. ...) verified locally using a public key. The private signing key should be kept only on the issuing server.

Data Handling

Generated code and Studio edits occur on your machine. You can review scripts in Studio before publishing.
AI requests may be sent to the configured AI provider(s) to generate scripts/plans.

Reporting Vulnerabilities

Please report security issues to security@oofstudio.dev. Include reproduction steps and impacted versions if possible.

Safe Defaults

Write actions are gated by tier (writeActions entitlement).
Credit limits enforce per-request and per-minute caps to prevent runaway usage.
Local bridge rejects non-localhost connections.