Hint system gamepass showing to all players

[Erikmb (HecknIrishMan)]

I have this script for a horror game where when the player is searching for items and they can’t find what they need, they can buy a developer product to highlight it. Currently, its happening on the server side to make sure that the purchase gets verified. But it also displays the highlight to the server, and not just the player who bought the product. I’m not too sure how I could move it to be local while also making it not exploitable so an exploiter can’t just give themselves the highlight

local productFunctions = {}

hintRE.OnServerEvent:Connect(function(player)
	local character = player.Character

	if character:WaitForChild("lives").Value > 0 then
		MarketplaceService:PromptProductPurchase(player, hintDevProductID)
	end
end)

productFunctions[hintDevProductID] = function(receipt, player)
	if currentHint.Value == 1 then --crowbar
		local highlight = Instance.new("Highlight")
		highlight.FillColor = Color3.fromRGB(0, 255, 255)
		highlight.DepthMode = Enum.HighlightDepthMode.AlwaysOnTop
		highlight.Adornee = Workspace.items["0"]:WaitForChild("fakeCrowbar")
		highlight.Parent = Workspace.items["0"]:WaitForChild("fakeCrowbar")
	elseif currentHint.Value == 2 then
        --etc for other items depending on what part of the game the players have entered
	end
end

local function processReceipt(receiptInfo)
	local userId = receiptInfo.PlayerId
	local productId = receiptInfo.ProductId
	local player = Players:GetPlayerByUserId(userId)

	if player then
		local handler = productFunctions[productId]
		local success, result = pcall(handler, receiptInfo, player)

		if success then
			return Enum.ProductPurchaseDecision.PurchaseGranted
		else
			warn("Failed to process receipt:", receiptInfo, result)
		end
	end

	return Enum.ProductPurchaseDecision.NotProcessedYet
end

MarketplaceService.ProcessReceipt = processReceipt

[Pure_Bacn]

After processing the receipt, instead of creating the highlight on the server, use a remote event to fire to the client who bought the product in order for the client to create the highlight.

[Erikmb (HecknIrishMan)]

Wouldn’t the highlight have to be created in a LocalScript that could be seen by exploiters and altered to work without the RemoteEvent?

[Pure_Bacn]

If there is an exploiter, they can already create a highlight in your game, so there is no point in stopping them from accessing a highlight someone else created.

[2112Jay]

List of paid players vs highlight is enabled … Don’t match up = kick/ban

[CZXPEK (czo)]

exploiters can only make the highlights on their client so you can only check if its enabled on a localscript which exploiters can easily stop

[2112Jay]

Exploring options …

@HecknIrishMan
I noticed this should be changed … to: workspace.items[“0”] – lowercase

Was able to get this working with a mock script and then tried a game pass script version.
Up to this point anyways, good luck. Here is the mock script …

local fakeCrowbar = workspace:WaitForChild("items")
	:WaitForChild("0"):WaitForChild("fakeCrowbar")

local function applyHighlight(player)
	local highlight = Instance.new("Highlight")
	highlight.DepthMode = Enum.HighlightDepthMode.Occluded
	highlight.FillColor = Color3.fromRGB(255, 0, 0)
	highlight.FillTransparency = 0.75
	highlight.Parent = workspace.items["0"]:WaitForChild("fakeCrowbar")
	highlight.Adornee = workspace.items["0"]:WaitForChild("fakeCrowbar")
	highlight.Enabled = true
end

local function GetPlayersWithPaidHints()
	return {"2112Jay"} -- build with pass list players
end
local playersWithHints = GetPlayersWithPaidHints()
for _, player in ipairs(playersWithHints) do
	applyHighlight(player)
end