Only thing i can suggest is don’t have scripts in workspace and for exploiters they can kinda use saveinstance still, but its way different and it doesn’t save scripts.
but yes they can steal your assets still just not scripts, you can maybe add a anti-cheat, but who knows if that will do any good. And never add free models! Here more info about security.