The sandbox

These rules keep you safe when you run a script someone else wrote.

What a script can't do

• Read or write files. The exceptions are its own storage and PNG images next to it (render.load_image).
• Open network connections.
• Use FFI, call native code or read raw memory.
• Load bytecode. load and loadstring are gone, and a file in bytecode form is refused.
• Use io, require, getfenv, setfenv, debug (except debug.traceback) or os (except os.clock, os.time, os.date and os.difftime).
• Run console commands.

Luau's string, table, math, bit32, utf8, coroutine, buffer and vector libraries all work.

Valve servers

On official Valve servers, cmd:set_view_angles has the same limits as Nyx's own aim: within 10 degrees of the camera, and at most 35 degrees per command. game.is_valve_server() tells you when they apply.