client-server-trustlisted

# Client-Server Trust ## Purpose A client is a program running on a machine the operator controls completely. They can read its memory, modify its code, intercept and forge its network traffic, and run it at any speed. Nothing the client says is evidence of anything. This is the single most violated rule in game and web development, and its violations are not stylistic -- they are duplication exploits, infinite currency, wallhacks, and account takeover. This skill states the rule, the reasoning, and the audit procedure, so that platform skills (`roblox-security`, `web-security`, `multiplayer-networking`, `minecraft-networking`) can apply it without restating it. **The rule: the client is a rendering and input surface. The server is the source of truth. A client message states an *intent*, never a *result*.** ## When to use - Designing or reviewing any client-server feature: movement, combat, economy, inventory, progression, matchmaking, chat, purchases. - Auditing an existing codebase for exploitability. - Deciding where a computation belongs. - Investigating suspected cheating, duplication, or currency inflation. - Any time a message from a client contains a number that matters. ## When NOT to use - Purely single-player, offline software with no shared state and no purchasable content. Save-file editing is a different (usually acceptable) threat model. - Trusted server-to-server communication inside one security domain -- though be sure it really is one. - Cr