Best Placement of Scripts/Tools to prevent Theft/Exploits without major lag?

[Xartsukina]

Attempting to wrap my head around how Roblox handles individual things while keeping track of which direction what events are called to what scripts into which modules for what remoteevent to keep the exploitable commands, properties, and variables out of the scum of roblox’s hands without sacrificing too much performance. … It’s killing me lol.

One thread is CERTAIN you can’t exploit a “Script” placed in a tool unless it’s Local Script, and another the guy wants help stopping exploiters who are manipulating data in a script on a Tool kept in StarterPack. One thread will say Tools are safe in Replicated Storage and another that only Server Storage then cloned to the player with scripts only in ServerScriptService taking remoteevents from a localscript. Then someone says that having Tools & Tool scripts in the Server spots only is too laggy.

Another thread says anything in Replicated Storage can be easily “stolen” by people looking to leak or copy your game and nothing should be there except Sounds & FX and that even Hitboxes in replicated can be hacked, but thread B says “it’s all server sided the client would need to genuinely hack the server to change them there”.

So what I have learned is: Most people here have no freaking clue exactly what is obtainable/exploitable from what storage area and I as a newcomer to roblox have no solid authority to look to for this information. Also that no matter how hard you try, thanks to the performance limits of roblox servers, you will inevitably have something exploitable so pick your battles.

.
.
.

Where you all come in!
To reiterate in case you skipped to the good part I am fairly Robloxgreen and I have no idea what areas will hit the performance too hard to be worth the effort to hide.

I need a visual table or something of where all of you consider the “best spot” for individual items with considerations for Limiting-Exploits & Preventing “Theft” of important code while attempting to maintain at least Acceptable Performance and WHY it’s the best spot so I can better understand the process.
i.e. DataStore & Loot Tables, Monster Handlers, Pathfinding, FX&Sound to be replicated to all clients. I have seen a few layouts where the primary DataStore is in ServerScriptService but then all the Item data such as Damage/Speed is kept in Replicated - if Replicated really is riskier then why not hide it all in ServerScript?

How do you handle your Tools, Damage, & Hitboxes, this is a big one I see people disagree on where to store them, how to call them, where to put the scripts that control them.

Gampasses / NPC Shop Data?

What items do you specify for network ownership? I see death state is one of the major exploit issues along with hitboxes.

What data do you hide in ServerScriptService/ServerStorage just to keep it out of prying eyes?

.
.
.

If I read and kept track of everything I think I understood from all the other threads I read over most games are setup something like:

DataStore = ServerScriptService with a “support” module in replicated to prevent some exploits? [that thread didn’t have a good example of what that module is or handles, curious on this one.]

Virtually everything else they keep in Replicated from FX to Sounds to Hitboxes & Damage Calc & Debris handler.

Most of them seem to keep a “Script” under each tool and some FX Local Scripts which include changes in MoveSpeed / Jump Power / sometimes even calculations for extras like Strength / Stamina etc in custom stat systems which shifts during an animation. Isn’t all of that exploitable? Isnt there a way to set a ModuleScript in the ServerScriptStorage to handle any Clone() to the player for a specific tool without it being too unresponsive? How/Where else do you recommend?

.
.
.

If I could get replies in a visual format something like
Tool=StarterPack > ToolScript=OnTool > RemoteEvent=OnTool > FX+HitBox&Damage=LocalScriptOnTool [because you love hackers and hate hitbox lag].
It would help when I start laying pieces together and reference here later.

Appreciate it!

[baseparts]

Anything on the client can be accesed, changed, and/or stolen. Theres way to make it harder but not to stop it.

When you play test the game and look in the explorer, youll notice you dont have access to all of the services. Thats because the client does Not have access to ServerStorage or ServerScriptService. This is because those services are not replicated to the client.

The client can Not access any Scripts no matter where they are parented. This is because the script gets replicated to the client, but not the content inside.

The client Does have access to LocalScripts as long as they are replicated.

They Do have access to module scripts, unless they are in a service that they cant access. So if you have a module the client isnt using, its best to store it in a non-replicated service like ServerScriptService or ServerStorage.

---

In your game, try keeping the amount of stuff you give the client to a minimum. Store models that the client doesnt always neer access to in ServerStorage, but store models that the client needs direct access to in ReplicatedStorage.

Store modules that only the server will ever use in ServerScriptService or ServerStorage.

For tools, its really just up to how you want it organized. Its totally fine to store Scripts inside tools (because the client cant access normal Scripts).

Just make sure to never trust the client. The client should never be “telling” the server to do something, like damaging someone. They should only instead be “requesting” to damage someone, and let the server decide if it actually should or not.

---

Sorry if this is a bit all over the place, theres a lot of stuff to go over. Hopefully this gives a good enough summary on some whats, does and donts

[Xartsukina]

Anything on the client can be accesed, changed, and/or stolen. Theres way to make it harder but not to stop it.
Kind of what I expected ;

The client can Not access any Scripts no matter where they are parented. This is because the script gets replicated to the client, but not the content inside. Good to know I got conflicting reports on this, I guess the issues people posted about those scripts being abused likely overlooked another location that had something exploitable.

They Do have access to module scripts, unless they are in a service that they cant access. So if you have a module the client isnt using, its best to store it in a non-replicated service like ServerScriptService or ServerStorage. Whoa! See I didn’t know that nor expect it.
Also wth the majority of the random tutorials I’ve watched I see people are throwing Item Data & Damage Handling & Hitboxes & even PlayerDataStore info in Module Scripts within Replicated - No wonder there is rampant exploiting.

---

Store modules that only the server will ever use in ServerScriptService or ServerStorage.
Hmm so InputController Module can be called from Replicated by a LocalScript send a FireServer to ServerScriptService for the actual Ability/HitBox/Cooldown handling then back to the LocalScript for rs:WaitForChild(“FXEffect”):Clone() to replicate the FX for (All?) Clients without processing on the server. Any sort of major lag/delay/performance hit with this scenario?
Is it possible to play the FX out for the client that initiated the Ability while the Server processes the important info and finishes replicating for everyone else to see? How would you exclude the single client out of the final FX replication so it doesnt appear twice? I think this would appear more “smooth” client side without sacrificing much.

As for Tools [think mostly swap-able weapons for me] still undecided where to put them or where to call them from, I really want to toss them all into ServerStorage and just Clone() to the Clients that own them upon login/DataStore load. No idea if that will hurt the performance or function of the tool.

[DevRNoOne (BLET Vader)]

Just for your info but currently there are issues with storing tool in ServerStorage and trying to copy it to player Backpack (even as roblox described first copy to ReplicatedSotrage and from there to Backpack). The problem is that it works if you do it for single tool, but if you try to loop tools that are in ServerStorage (especially put in a folder or model) nothing happens. I don’t know if this is a known issue but in my opinion it should be resolved because for me ServerStorage is the place to store everything that is not granted to the client (before purchase or achievement).