Exploit Detection with Tamper

Tamper tracks malformed requests automatically and lets you issue manual strikes for game-logic violations. Kick players when they exceed a configurable threshold.

Setup

copylocal Tamper = RoExpress("Tamper")

-- Subscribe to all strike events (immediate and pattern)
Tamper.On(function(report)
    print(report.player.Name, "strike #" .. report.strikes, report.reason)
end)

-- Optional: auto-kick when a player hits 5 strikes
Tamper.AutoKick(5, "Exploiting is not permitted.")

-- Optional: tune pattern detection thresholds
Tamper.SetThresholds({
    rateFloodWindow = 60,  -- seconds
    rateFloodCount  = 5,   -- 429s within window triggers pattern strike
    routeScanCount  = 8,   -- distinct unknown routes
    paramFloodCount = 5,   -- repeated param failures on same route
})

Automatic strikes

Tamper automatically issues a strike when App or Port receives a request it can't parse | wrong method, malformed payload, invalid route. No extra setup needed.

Manual strikes

Issue strikes from your own handler when game logic is violated.

copyapp:Post("combat/hit", function(Player, Payload, req, res)
    local damage = req.data and req.data.damage
    if type(damage) ~= "number" or damage <= 0 or damage > 100 then
        Tamper:Strike(Player, "invalid damage value: " .. tostring(damage))
        res:Status(400):Error("Invalid")
        return
    end
    -- process valid hit
end)

Threshold tuning

See also

Tamper API  ·  Stream Guide | combining lag compensation + tamper  ·  TokenBucket | rate limiting as first line of defence  ·  Middleware | additional validation layer