Is it safe to expose Module to a local script?

[noahsneat (Noah)]

I have this, in a module script.

local GameManager = {
	["status"] = "lobby",
	["time"] = 60
}

local Players = game:GetService('Players')

function GameManager.tick()
	if (GameManager.time==0) then
		if (GameManager.status == "lobby") then
			if (#Players:GetPlayers()<2) then 
				return print('Not enough players to start!')
			end
			
			GameManager.status = "game"
			GameManager.time = 300
		else
			GameManager.status = "lobby"
			GameManager.time = 60
		end
	else
		GameManager.time = GameManager.time - 1
	end
end

return GameManager

I was wondering if it was safe, with my current setup to expose this module in a LocalScript that updates a UI element based on the time property. I wouldn’t want exploiters being able to spam GameManager.tick() a whole bunch, causing the timer to go haywire. Thanks!

[waves5217 (waves)]

Completely safe in terms of game security. The server ought to always be the authority and manage the game. If someone deliberately spams your tick function out of order on their local computer, that’s none of your concern. It won’t affect the server in any way. The client will be spoiling their own game, respectively their own version of the game and their UI display.

What you shouldn’t do is have your server trust the client and orient itself in accordance to what clients do.

Additionally, if you share a module, let’s say in ReplicatedStorage, server and every client have their own versions of the given module.

[noahsneat (Noah)]

Thanks, I’ve added an assertion just in case this still happens as a sort of anti cheat.