Okay, let's talk about it.
Last week a YouTube video came out called Rscripts is malicious. If that's how you ended up here, good. You should hear both sides.
Quick version if you are scrolling: stealers did make it onto Rscripts, and that is on us. But we never ignored them. We have always done something about stealers, just not enough. So we rebuilt how scripts get onto the site.
What the video got right
As much as we understand the criticism, let's start with the fair part.
- Stealers and fake login scripts were live on the site, some of them for way too long.
- Some scripts got approved that never should have been.
- Good scripts sat in review for weeks while bad ones got through.
That's real, and we're not going to argue with it.
What it got wrong
The video was over the top, and the framing was bad.
The title says Rscripts is malicious. Rscripts isn't malicious. The people uploading stealers are, and we're the ones banning them.
The video also says we just sit there and don't care. Here's what that has looked like so far:
Two more things worth knowing when you watch it:
- The 2.7 million hits. That number is on the stealer service's own dashboard. It counts that whole tool, wherever it gets used. It is not a count of people hit through Rscripts.
- Who's talking. The video has a referral ad for an executor shop, and it ends by recommending another script site that the creator talks about as "we". That doesn't make the stealers fake. It does mean this wasn't a neutral review.
We should still have done more, sooner. Both things are true.
Why it wasn't enough
The people uploading stealers use AI now. We block one trick, and a few hours later a reworked version shows up. At the peak we were getting over a thousand uploads a day, and in one month our moderators removed about 19,000 scripts by hand.
Nobody wins that race by hand. So we stopped running it and changed the rules.
What we changed
Here's the short version, and it is short on purpose. Attackers read blog posts too, so we won't spell out what we check or how.
- Throwaway accounts can't just post. Publishing a new script now takes a verified Discord, and there's a daily limit until you've built a track record.
- New scripts have to earn the feed. Most scripts from creators without a track record don't hit the front page right away anymore.
- Scans got a lot stricter. Every new script and every code change gets scanned, and we look at far more than we used to. Anything serious stays down until an admin has looked at it.
- Reviews have consequences. A script in review needs several officers to agree. Approve something bad and it counts against you. Keep doing it and you're out.
- Reports work faster. Solid reports of malicious code on a fresh script take it off the site until officers have checked it.
- Coming back after a ban is harder. A new account doesn't mean a clean start.
- We can hit the brakes. If a big wave comes in, we can pause all uploads and edits across the site in one click.
- Your account got safer too. Sign-ins from a new location ask for an email code, and you can turn on 2FA with an authenticator app.
Honest creators get something out of this as well. You can now see your place in the review line and an estimate on your dashboard. Reviews that get stuck close instead of rotting, and you can ask for a fresh one with one click.
Before turning this on, we ran 35 days of old uploads through the new rules:
That's a test on old data, not a promise. Attackers will adapt, and so will we.
What this doesn't fix
Nothing catches everything, and anyone who says otherwise is lying. We're also still working through older scripts, so a bad one can still be out there.
The feed will feel slower for a while too. That's the trade, and it's the right one.
How to stay safe
- No script needs your Roblox password. If one copies a link and asks you to log in, close it. Real Roblox links end in
roblox.com. - Never paste your cookie or token anywhere, no matter what a script or a tutorial tells you.
- If a key system just loops forever, there probably is no key. Move on.
- See something sketchy? Report the script and pick Malicious Code.
Thanks for sticking with us.