Please some confirm or deny this for me. Sorry if this is a dumb question 
I’m having a very hard time believing instances such as NumberValues and IntValues are safe for use concerning FE. I feel so stupid and confused rn and I need someone to confirm it.
Let me give you an example:
A part named “Wall” in workspace. It has a NumberValue named “Health” with a value of 500. Is this ok??? I seriously feel stupid rn please help
If you are concerned about the safety of the Value then make something in ServerScriptService that ensures the value was not changed illegitimitely.
Other than that, Values are for the most part safe.
As far as I know, anything server sided is safe from potential exploiters. But surely there are more effective ways of initiating this.
Thank you.
Value instances are 100% safe as long as they are held on the server.
On the client, they can be edited locally so watch out for that.
I would generally advise avoiding values outside of scripts when possible though.
If you have store Values in the Workspace or ReplicatedStorage, the client can access these and change them. These changes do not replicate to the server as FilteringEnabled is on.
You’ll most likely only be doing things with these Values server side so it’s fine if you place them in the Workspace or ReplicatedStorage.
An example of this would be in a game like Fortnite. Each structure (wall, floor, roof, etc) has a Health value associated with it stored inside the structure so that the client can access the Health Value and see get told much health the structure has. When the user damages the structure, all the damage / destruction code is done on the Server. So even if someone were to edit the Health value, the server would see the real value which hasn’t been altered by them.
Anything in workspace is at risk of an exploiter being able to access it(edit it in your case).
That’s true but it won’t replicate to other clients or the server through FE so it should be fine.
If in doubt, don’t forget the first 3 rules of client/server.
If it’s on the client, you should expect it to be tampered with in some way; and protect yourself that way.
Values are safe as long as you don’t read the data from a client script and try to push it through the server, example:
RemoteEvent:FireServer(Value)