I was wondering if it’s ‘safe’ to give players network ownership over a crucial element in the game. My main question is: what properties replicate from the client to the server? What if a client created an instance in the part they can control? What instances would replicate? How would I prevent the part from being abused?
Thanks for the answers 
when the player has network ownership of a part it will get to send the CFrame and i believe the velocity is also sent to the server and the server will blindly except this CFrame and velocity and pass it onto all other clients
when the other clients get this new CFrame they will update the position of the part with the new CFrame (roblox does a very small amount of tweening so that the part don’t stutter)
within the frames that the other clients does not get the updated CFrame it will use the velocity to guess where the part should be
if a new part is created on the client side it is not replicated to the server
the server relies on the client to tell it when events happen for instance the client will tell the server when it touches a part
this video here might help you understand what types of powers exploiters have
Thanks for your detailed reply!
So I understand that only physics replicate from the part onto the server. So that would be the Position property (and other properties related to it, example: CFrame) and stuff like Orientation. What about the instances created in the part. What types of those instances replicate (if any of them do)?
Thanks for linking the video, good one. But I can kind of understand what are the possibilites of exploiters (I’m just worried what kind of stuff is picked up by the server and sent to the other clients).
only the CFrame and Velocity and Angular Velocity
position and rotation don’t really exist there just a part of the CFrame
any instances created inside or outside will not be sent to the server