I am thinking about making a ModuleScript in ReplicatedStorage containing all of the item data for my shop(kill effects, boosts, etc), but I am not sure if that would be exploiter friendly. I am aware that ReplicatedStorage objects changed from the client won’t be changed on the server, and I want item data to be viewed by both the client and the server. What do you say about this idea as a whole?
I don’t see a problem with it. I’ve had a practice of creating modules that can be accessible by both client and server. As long as you’re using the shop data in the module for read-only stuff, you’ll be fine. Like, if you wanna make sure a player can afford an item in the shop, call a remote event to the server for that to verify that the price is correct and the player truly can afford it/buy it. 
4 Likes