Letting the client handle hitboxes?

Protecting a game is not something I have a lot of experience with although I do know some of the basics like doing sanity checks, however, for things like letting the client handle hitboxes it’s a bit complicated. My biggest issue is an exploiter could activate the hitbox of another class and my code doesn’t have a way to check for that.

The server will however make sure that it does the right amount of damage and be on cooldown for the correct amount of time, but in terms of the hitbox being in sync with the attack I got nothing.

All of this is client code FYI.

local function canDoAction(ActionName : string)
	local success = actionRE:InvokeServer(ActionName)
	return success
end

function Input:InputBegan(inputObject, gameProcessed)
	if gameProcessed then return end
	if UI:GetCurrentMenu() == "StartScreen" then pressAnyKeyToStart(inputObject) return end
	if self.Player:IsDead() then return end
	if self.Player.ClassName == nil then return end	

	local className = self.Player.ClassName 
	local classModule = require(classModulesFolder[className])

	if inputObject.UserInputType == Keybinds.PrimaryAttack and canDoAction("Ability2") then
		classModule.Ability2(self.Player)
		return
	end		
end
Reaper.Ability2 = function(player)
	local character = player:GetCharacter()
	
	player.Animation:PlayAnimation("Ability2")		
	player.Hitbox:Ability2() -- they can just change this
	
    -- and this
	coroutine.resume(coroutine.create(function()
		Leap(character,5,0)
		task.wait(0.5)
		Leap(character,-25,0)			
	end))
end