I’m kinda interested in making a CTF (Capture-The-Flag) game similar to other cybersecurity games that would intentionally leave bugs in levels and challenge the player to complete a certain task (find a flag). Then after the level is completed it would describe in details the problem and how to secure your game from it.
The player would have a GUI command prompt (made using loadstring()) or just a intentionally glitchy element of the level.
An example level could be a store that checks the amount of coins on the client side before buying an item and then sends a RemoteEvent to the server to add that item to the player’s inventory without checking the amount of their coins. The player has to get that item despite having no coins.
My question is, is something like this allowed?
My only intention is to teach other developers how to secure their games.