{"id":"hexcede/h6x","name":"h6x","scope":"hexcede","platform":"roblox","description":"A luau utility for constructing sandboxes to run code within.","version":"2.1.3","latest":"2.1.3","versions":["2.1.0","2.1.1","2.1.2","2.1.3"],"license":"MIT","licenseRating":"safe","licenseCaveats":[],"licenseVerified":true,"dependencies":{},"integrity":"05c30be6d947bfd32377c15ac6792322d5ed40ad733f8dc0869e0d7e55cf9e8b","likes":0,"downloads":0,"install":"forest install hexcede/h6x","url":"https://forest.dev/p/roblox/hexcede/h6x","files":"https://api.forest.dev/ai/package/roblox/hexcede/h6x/files","readme":"# H6x\n\nH6x is a script sandboxing tool designed with compatability and security in mind.\n\n## Here be dragons\n\nIf the security of your game's data/playability is a concern to you, please take a moment to read the following carefully before you proceed, and make considerations.\n\nWhile H6x itself is designed to be secure as a sandboxing tool, that does not mean that insecure/improper usage is impossible and can't exist.\n\nH6x is merely a tool for constructing sandboxes & environments to run trusted, or untrusted code in. While it intends to be user friendly, and make it easy to securely execute untrusted code, you should be aware of the risks of doing so, and the ways in which you may provide unwanted access to pieces of your game.\n\nAvoid providing more than you explicitly intend to provide. For example, if you intend to allow users to create mods for your game, it is recommended that you create a unique and entirely separate API that interacts with internal ones indirectly. You should avoid letting untrusted code interact directly with important code, and you should sanitize function arguments.\n\nMetatables and function environments (fenvs) are important to take into account if security is of concern to you. When you call H6x APIs, H6x executes code inside of individual container scripts, which stops user code from accessing caller envs by simply taking advantage of Roblox's own functionality, but, calling user functions directly without the use of H6x APIs can allow access to your caller scripts' fenvs. If you want to be extra safe, you can always disable these features if you don't intend to let untrusted code use them.\n\n## Getting Started\n\n### Importing H6x\n\n1. Download a release from [releases](../../releases), build an rbxm with the steps in [Building from source](#building-from-source), or see [Integrating with Rojo projects](##integrating-with-rojo-projects).\n2. Import the rbxm into your game.\n3. Run the game, and ensure that H6x does not display any errors in the Output view (Roblox Studio -> View -> Output)\n\n### Setting up H6x in your game\n\nTBD\n\n## Integrating with Rojo projects\n\nAlternatively, H6x can be integrated directly within your Rojo projects.\nSimply place H6x somewhere outside of your project tree, and target `default.project.json`:\n```json\n{\n\t...\n\t\"H6x\": {\n\t\t\"$path\": \"../path/to/H6x/default.project.json\"\n\t}\n\t...\n}\n```\n\nYou can do this from another project file inside of your `src` tree, or from your main project file.\n\n## Building from source\n\nTo build H6x, first install Rojo, or use Foreman, and run the following command once you have cloned the repository:\n\n```bash\nrojo build -o \"H6x.rbxm\"\n```\n\nFor more help, check out [the Rojo documentation](https://rojo.space/docs).\n","readmeTruncated":false}