Roblox networking is
quietly breaking your game

-- ReplicatedStorage
-- ├── PlayerDataRequest
-- ├── ShopBuyRequest
-- ├── ShopSellRequest
-- ├── CombatHitRemote
-- ├── AdminKickEvent
-- ├── LeaderboardSync
-- ├── RemoteEvent14
-- └── ... 29 more

-- Every script wires up its own remote
local buyRemote = RS:WaitForChild("ShopBuyRequest")
local sellRemote = RS:WaitForChild("ShopSellRequest")

buyRemote.OnServerEvent:Connect(function(player, data)
    -- what shape is data? who knows
end)

-- One remote. Every route in one place.
local app = RoExpress.GetApp()

app:Post("shop/buy/:itemId=string",  handler)
app:Post("shop/sell/:itemId=string", handler)
app:Post("combat/hit",              handler)
app:Post("admin/kick/:userId=number", handler)

-- One global middleware log for everything
app:Use("logger", function(player, payload)
    print(player.Name, payload.method, payload.route)
end)

-- You have to write this for every single remote
local lastFired = {}

remote.OnServerEvent:Connect(function(player, data)
    local now = tick()
    if lastFired[player] and now - lastFired[player] < 0.5 then
        return -- silently drop, no kick, no logging
    end
    lastFired[player] = now

    -- now validate data... manually... every time
    if typeof(data) ~= "table" then return end
    if typeof(data.itemId) ~= "string" then return end
    -- ...
end)

-- Rate limiting: built in. Runs before every handler.
-- Tamper: passive exploit detection, auto-strike.
-- Types: enforced in the route string itself.

app:Post("shop/buy/:itemId=string", function(req, res)
    -- req.params.itemId is already a string
    -- player already rate-checked (429 if over limit)
    -- payload already validated (400 if malformed)
    -- version already verified (silent drop if spoofed)

    ShopData.Buy(req.player, req.params.itemId)
    res:Send()
end)

-- Pasted into every admin handler. Every single one.
kickRemote.OnServerEvent:Connect(function(player, target)
    if not AdminList[player.UserId] then return end
    -- actual logic
end)

banRemote.OnServerEvent:Connect(function(player, target)
    if not AdminList[player.UserId] then return end
    -- actual logic
end)

announceRemote.OnServerEvent:Connect(function(player, msg)
    if not AdminList[player.UserId] then return end
    -- someone will forget this one day
end)

-- One middleware. Covers every admin route.
app:Use("admin", function(player, payload)
    if payload.route:sub(1, 6) ~= "admin/" then return end
    if not AdminList[player.UserId] then return false end
end)

-- Handlers contain zero auth boilerplate
app:Post("admin/kick/:userId=number",     kickHandler)
app:Post("admin/ban/:userId=number",      banHandler)
app:Post("admin/announce",              announceHandler)

-- Client fires and hopes for the best
buyRemote:FireServer({ itemId = "sword" })

-- Need a result? Wire a second remote back
local resultRemote = RS:WaitForChild("ShopBuyResult")
resultRemote.OnClientEvent:Connect(function(success, msg)
    -- hope the server fires this before timeout
    -- what timeout? you don't have one
end)

-- Callback style: one round-trip, one response
network:Post("shop/buy/sword", nil, function(res)
    if res.ok then
        UI:ShowSuccess("Purchased!")
    else
        UI:ShowError(res.data.message)
    end
end)

-- Promise style: chainable, with auto-retry
network:PostAsync("shop/buy/sword")
    :Then(function(res) UI:ShowSuccess() end)
    :Catch(function(err) UI:ShowError(err.message) end)

-- One FireAllClients per player per tick
-- Table overhead, no compression, no delta
RunService.Heartbeat:Connect(function()
    for _, player in Players.GetPlayers() do
        stateRemote:FireAllClients({
            userId   = player.UserId,
            position = player.Character.HumanoidRootPart.Position,
            health   = player.Character.Humanoid.Health,
            -- full table every tick, no delta
        })
    end
end)

-- One packed buffer per tick, all players
-- Delta compression built in
local ch = Stream.Channel({
    userId   = "uint32",
    position = "vector3",
    health   = "float32",
})

RunService.Heartbeat:Connect(function()
    for _, player in Players.GetPlayers() do
        ch:Write(player.UserId, {
            position = player.Character.HumanoidRootPart.Position,
            health   = player.Character.Humanoid.Health,
        })
    end
    ch:Flush() -- one FireAllClients, only changed records
end)

-- Written from scratch, every time, in every game
local HS = game:GetService("HttpService")

local function sendWebhook(winner)
    local ok, err = pcall(function()
        HS:RequestAsync({
            Url    = WEBHOOK_URL,
            Method = "POST",
            Headers = { ["Content-Type"] = "application/json" },
            Body   = HS:JSONEncode({ content = winner .. " won!" }),
        })
    end)
    if not ok then
        -- retry? manually? give up?
    end
end

-- Configure once. Use everywhere.
local webhook = RoExpress.Harpy.New({
    base    = WEBHOOK_URL,
    retries = 3,
})

-- Body JSON-encoded automatically
-- Retries on failure automatically
-- Headers set once, used on every call
webhook:Post("", { content = winner .. " won!" })

-- Multiple APIs? One client each.
local scores = RoExpress.Harpy.New({ base = SCORES_API })
scores:SetHeader("X-Api-Key", API_KEY)