Remote events

LoadAsset with a client's id can pull any model the creator owns into the live game. How to use server-side lists and AssetTypeVerification.

When a remote sends a price, reward or damage value, the client decides it. How to send only the player's choice and look everything else up on the server.

A typeof check alone lets negative numbers, NaN and infinity through. How to write range checks for amounts, quantities and stock that reject all three.

Every argument after the player in OnServerEvent comes from the client. How to check types with typeof, use allowlists and reject bad values before they reach saved data.

Checking an Instance's class doesn't prove the player may use it. How to check a tool, part or model sent by the client belongs to that player.

Connecting OnServerEvent inside PlayerAdded and using the outer player lets one client act for everyone. How to connect remotes once and use the player argument.

Logging funnel steps and economy amounts the client reports lets exploiters fill your dashboards with false data. How to check events on the server.

Only the last OnServerInvoke assignment runs, so a leftover script can silently replace your checks. How to find and remove duplicates.

Anything sent to a client or left in ReplicatedStorage can be read. How to send each player only what they're allowed to know.

RemoteFunction:InvokeClient lets a client stall or break server code. How to replace it with two RemoteEvents and a timeout the server controls.