How can I make this script more secure?

Hi devs,

I’m wanting to know how to make this script more secure.
From what I know there’s no way to detect when a tool is un-activated, and no way to get the mouse from a ServerScript, so I have to use a LocalScript to get the mouse position and target.

This is the LocalScript:

local shootDebounce = false
local mouse1Down = false

game.Players.LocalPlayer:GetMouse().Button1Down:Connect(function()
	if game.Players.LocalPlayer.Character then
		if script.Parent.Parent == game.Players.LocalPlayer.Character then
			if script.Parent.FIREMODE.Value == "AUTO" then
				mouse1Down = true
				repeat
					task.wait()
					if not shootDebounce then
						shootDebounce = true
						script.Parent.Shoot:FireServer(game.Players.LocalPlayer:GetMouse().Target, game.Players.LocalPlayer:GetMouse().Hit)
						wait(script.Parent.FIRERATE.Value)
						shootDebounce = false
					end
				until not mouse1Down
			end
		end
	end
end)

game.Players.LocalPlayer:GetMouse().Button1Up:Connect(function()
	mouse1Down = false
end)

And the ServerScript:

local shootSound = script.Parent.ShootPart.Shoot

script.Parent.Shoot.OnServerEvent:Connect(function(plr, hit, pos)
	shootSound:Play()
	if hit then
		if game.Players:GetPlayerFromCharacter(hit:FindFirstAncestorWhichIsA("Model")) then
			if hit:FindFirstAncestorWhichIsA("Model").Humanoid.Health > 0 then
				local particle = game.ReplicatedStorage.BloodParticle:Clone()
				particle.CFrame = pos
				particle.Parent = workspace
				particle.Attachment.Particle:Emit(1)
				hit:FindFirstAncestorWhichIsA("Model").Humanoid:TakeDamage(10)
				wait(1)
				particle:Destroy()
			end
		else
			local particle = game.ReplicatedStorage.HitParticle:Clone()
			particle.CFrame = pos
			particle.Parent = workspace
			particle.Attachment.Particle:Emit(1)
			wait(1)
			particle:Destroy()
		end
	end
end)

I think this topic would be suited in, Help and Feedback > Code Review more. Correct me if I am wrong.

Edit:

Your code already works, however you want to improve its security. Therefore, it might be better suited in code review instead.

I’m trying to get help on making it better, rather than asking for feedback / reviews on it, so I don’t think so

Yep, this is not secure at all.
You should only pass the direction vector to the server. Then, using this direction vector you should raycast and check for result.

1 Like