rbx.lol

Privacy and security

Exactly what crosses the network, what is stored, where, and who can see a session.

What crosses the relay#

Everything the interface shows: remote calls and their arguments, HTTP requests and responses, instance names and properties, script sources, console output. That is the data you asked to see, captured on your machine and displayed in your browser.

It crosses over TLS (wss://), so it is encrypted in transit.

What the relay stores#

Nothing.

Frames are forwarded byte for byte. The relay does not parse them. Many are LZ4-compressed and base64'd, and reading one would mean decompressing it first.

The only state it holds is, per live session:

  • the room code
  • which sockets belong to it
  • when they last spoke, so dead ones can be swept

There is no database. Frame contents are never logged and never written to disk. A room with nobody in it is deleted a minute later.

What your browser stores#

Two kinds of data, held differently on purpose.

Captured game data stays in memory, in this tab. Remote calls, web traffic, console output, the Explorer's structure and decompiled sources are all derived from the game you are attached to. Close the tab and they are gone; reattach and the game produces them again. Nothing captured is written to disk.

Your own work persists. Editor files, the Roblox API data behind autocomplete, the room code and interface settings are saved in this browser and survive a reload.

That means:

  • Closing the tab clears every capture
  • Your editor files and room code stay until you delete them
  • Nothing leaves your machine. There is no account and nothing is uploaded

Shared or public computers

Captures clear themselves with the tab, but editor files and the room code persist. On a shared machine use a private window, or clear site data for rbx.lol when you are done.

Who can see a session#

Anyone with the room code, and nobody else. Anyone you send it to can join your room and watch the same traffic.

A room holds one game and any number of browser tabs, so the debugger and the RBX Editor can share one room code. A second executor joining the room replaces the first, and the replaced client is told so and stops reconnecting.

What we can see#

Operationally: how many rooms are open, and that a socket connected. That is what the health endpoint reports and what the process logs.

Not your room's contents, your game, your account, or anything inside a frame.

Running it yourself#

The client dials whatever getgenv().NETBRIDGE_URL says, ahead of the address the hosted build writes into it. Point it at your own bridge:

Luau
getgenv().NETBRIDGE_URL = "ws://localhost:9000/"
loadstring(game:HttpGet("https://rbx.lol/netbridge/client.lua?room=ABCD234XYZ"))()

The room code still has to be in the link, because the server refuses to serve a client without one. Nothing else touches the network beyond your own machine.

The caveats#

  • Your executor sees everything anyway. RBX Debugger does not grant access it did not already have. It displays it.
  • A relay operator could log frames. This one does not, and the source is available so you can check. If that is not good enough for your threat model, run it locally.
  • Roblox may consider executor use against its terms. That is between you and Roblox, and it is true of every tool in this category.