Is this exploitable?

This is a module script located in ReplicatedStorage.

It returns the function so I can use it my GUI scripts.

return function() 
	local HatStats = {  
		Cost = 5, 	
	} 
end 

So can this be changed in any way? Basically I can access the information, but can let’s say “Cost” be changed by an exploiter? Thanks for the help.

Theoretically An exploiter can modify the value of the cost, but as long as you compare the cost of the hat on the server when a user sends a request to purchase the hat, you should be fine because the change wouldn’t replicate.

The client cannot change the information in the module to replicate on the server. They both receive their own copy of the module.