Can exploiters interfere and edit a LocalScript, etc

Help and Feedback Scripting Support
#22

I’ve seen how long this discussion has gone but I just fixed around my code and I tried to change up a few values and I made it Un-Exploitable from what I’ve tested. Everything is on the server

#23

Yes never trust the client, ever

1 Like
Is there any way to make a variable not change its value for anything in the world?
#24

This is what I do, but enjoy making an anti-exploit server-sided.

#25

I knew that before but I wasn’t sure how extensive these exploiters could actually get.

1 Like
#26

It really depends on the exploiter, I doubt harkinian with his severe damage scripts will join your game. If its some skid I would not worry.

1 Like
#27

The issue is that while no, they cannot edit a local script per say, they can

  • get the contents of that script
  • duplicate that code in a new script that they can edit

I wouldn’t make a local script that has access to private information that isn’t the client’s.

Remember that this only happens in that server/game instance and unless you give them access to, cannot replicate to other clients.

#28

Why store private information in ANY script in the first place? LocalScripts cannot do much but send data to the server with a remote for something that only the client can see.

Edit: Unless its a webhook or a cookie I guess.

#29

The main thing I was asking was if an exploiter could change the quantity of the thing you sell in my game in the script but I changed that…

#30

Let’s say you want to use a webhook to send information from the client to discord. The webhook link needs to be on the server to avoid exploiters getting to it.

#31

Yeah lol, just realized that. I thought it depended on whatever kind of private information you were talking about.

1 Like
#32

Exploiter Could Could Edit An Localscript. That’s Why You Should Secure The Script, Make It Safer. Read This Forum : How To Prevent Exploiters / Cheaters Properly

#33

If only Roblox would send the script instance together with the player… No instance is the same. If you would do :FireServer(script). It would never match with any other script no matter how identical they may be, & you can check this on the server. Sadly an exploiter still has as much control over this from the client as you, so it would make no difference. But they wouldn’t if Roblox sent that information forcefully same way with player. Would make huge benefit to always confirm the script is your original script from the server side. OnServerEvent:Connect(function(plr,source)

#34

API keys, webhooks, etc etc. When I said personal info I didn’t mean personally identifying information which is more for web security. In that case, no, you should not put your home address in a server script.

Edit: don’t know why I replied twice.
I was just looking at my replies, sorry