Can exploiters access my _G explosion function

[Paintertable]

Basicly I have a global function that is there to create explosions. I have it because I often use that explosion and it just makes it easier.

Basicly I am calling a position for the explosion and a explosion model.

Is it possible that the exploiter can access that somehow and create explosions everywhere? How secure is it and how could I make it more secure?

[Automationeer (Eleanor)]

Exploiters can access anything on the client no matter what. You should always (always) assume that anything a user does is malicous until proven otherwise.

Rule 1 of network security: Never trust the client
Rule 2 of network security: NEVER trust the client

Further reading:

Exploiting Explained

Exploiting Explained: Second Revision This post is a general information source on common exploiting terminology, tools, and methods. The formatting is in sections for each specific topic, and is in no specific order. If you’re not aware of exploiting by this point, you’ve probably been living under a rock that the pioneers used to ride for miles. While Roblox is seen as open grounds for free reign of exploits, this isn’t the case, and I attempt to tackle this wrong assumption in this post. Th…

My anti-cheat was decompiled. What do I do now?

There are a number of things to consider, and a lot of great points made by others in this thread. Clients can be compromised. You can make your non-compromised game clients work for you (but if they can decompile your anti-cheat, they can decompile that, too and get ideas for how to tweak them). What I want you to consider is that this is your game, and you are responsible for the game mechanics and the game being fun. If players are abusing the game to get some benefit figure out how to wor…

[sjr04 (uep)]

Or don’t use _G in the first place. Use of _G is bad practice. It’s exactly why you don’t use global variables - name collisions. Consider bindables/module scripts.

[desuhookvw]

They can only access it if its on the client, if it is on the server then they cannot access it.

[Automationeer (Eleanor)]

@coexperience

Exploiters can access anything on the client no matter what.

You didn’t read my post. At all.

EDIT: The OP doesn’t specify that their function is on the client or the server.
If it’s on the server you’re fine @Paintertable (but you should use a module script instead of _G)
If it’s on the client then an exploiter can access it.

Do note that if you have something like a MakeExplosion remote event, exploiters could abuse that.

[Paintertable]

Jeah it’s on the server, mad bad guys. Okey good to know :))

[SenorSbeve (sbeve)]

There is a _G for the client, and a _G for the server. The server can read server _G code written in server scripts, and the client can read _G code written in client scripts Basically, an exploiter would not be able to access your function unless you put the function on the client. If it is on the server, then there is no way they’ll be able to access it.

[colbert2677 (Dreamseeker)]

Even if an exploiter could access your function, why would that matter? They can create explosions manually without the use of your function in _G. That being said; _G is different per machine and per client, so you’re fine. Why use _G when you can use ModuleScripts though? Fits code structure better.

[Paintertable]

That’s true and thats what I normaly do tbh.
I just though this fittet more in my code structure but I am happy to change that.

Thanks :))