I’ll get straight to the point, our game finally got a nice playerbase of a few hundred but with them came some exploiters, and one issue seems to be that they can inject a loud song that plays for everyone (even if rejoining).
There is absolutely no remote event that plays a sound on the server with custom ID and volume, SoundService has RespectFilteringEnabled set to true, and remote events are secured both with debounce and in contextual sense.
I even tried to search for the sound with the dev console when I encountered an exploiter that did this, even stopped every sound with :GetDescendants() but the music still kept playing (I suspect they used PlayOnRemove.)
Backdoor wise I have found nothing out of the ordinary, no getfenv or loadstring instances found by the search feature, and all the require references are normal, me and my colleagues checked our plugins too if they are original or copy.
Is there anything I missed? I am genuinely confused at how they do this if there is no remote event that does this + no backdoor…?
EDIT: I found that the exploit is placing a sound in game.SoundService, as a temporary workaround I added a serverside loop that constantly clears its children. This is semi-solved, as I still wanna know the science behind this.
