Do checks on the server and client, server is the most important as its the final decision.
Prevents exploiters from deleting the workspace and everything in the game provided that your remote events and remote functions are secured (basically).
Public ones? Well yes but mostly you should design an custom anti-cheat for your roblox game.