Is utilizing the StarterPlayer folder in the Workspace a security risk?

[Clueless_Brick]

Heya.

I had a question regarding about securing my game and whether this is a smart idea or not.

I have been placing BoolValues inside the StarterCharacterScripts so my GameScript can navigate through the values within Clients.

Furthermore, I am also doing my best to try and secure the game to the best of my ability. Is this method considered faulty and impractical? Should I rather just script all the values from ServerScriptService?

To make this post less confusing: should I rely on the StarterPlayer/StarterCharacterScripts folder, or is it considered inefficient / bad practice?

[cjjdawg]

There is a bug present where anything destroyed in the character gets replicated to the server, this could potentially break your server scripts if not handled correctly, for now it is best to store value objects outside of character, it is completely safe since they will be managed from the server.

Client destruction of character objects replicates to server

While developing an anticheat, I discovered that exploiters can destroy any individual object in their characters, including non-physical items like decals, joints, and scripts, and that destruction replicates to the server. This behavior is also not documented where it should be. This can happen pretty much everywhere that uses the default characters familiar to Roblox players, and is not limited to Roblox Studio. For example, if I run this script on my client, my limbs and t-shirt disappear …

[Clueless_Brick]

So to clarify, I should:

1.) Create a server script within the the ServerScriptService.

2.) Have that server script responsible for managing/creating the values. For ex.:

local RS = game:GetService("ReplicatedStorage")

game.Players.PlayerAdded:Connect(function(player)
	player.CharacterAdded:Connect(function(character)

		local afkVal = Instance.new("BoolValue")
		afkVal.Name = "AFK"
		afkVal.Value = true
		afkVal.Parent = character
		
		--Then so on more values added ect. ect.
	end)
end)

Is this correct?

[cjjdawg]

Your still putting them inside the character, either put them in the player or another location