Never trust the client: securing RemoteEvents your AI wrote

Exploiters can run their own code on their own computer. That means anything a LocalScript does, they can change, and any RemoteEvent the client can fire, they can fire with any arguments, as often as they like.

AI agents often write remotes like this:

-- Server (unsafe)
Remotes.AddCoins.OnServerEvent:Connect(function(player, amount)
	player.leaderstats.Coins.Value += amount
end)

An exploiter fires AddCoins with amount = 999999999 and your economy is gone.

The rule

The client asks. The server decides. The client may say “I want to buy the sword”. The server checks whether the player can afford it, whether the sword exists, whether they’re close enough to the shop, and only then changes anything.

-- Server (safe)
Remotes.BuyItem.OnServerEvent:Connect(function(player, itemId)
	if typeof(itemId) ~= "string" then return end
	local item = Items[itemId]
	if not item then return end

	local coins = player.leaderstats.Coins
	if coins.Value < item.Price then return end

	coins.Value -= item.Price
	grantItem(player, itemId)
end)

Checklist for every remote

• Type-check every argument. Use typeof(). Exploiters can send tables where you expect numbers.
• Never accept amounts, prices or rewards from the client. Look them up on the server.
• Check distance and state. Is the player alive? Near the shop? Is the round active?
• Rate-limit. Ignore a player who fires the same remote 50 times a second.
• Keep secrets on the server. Item tables, drop rates and admin lists belong in ServerStorage or ServerScriptService, not ReplicatedStorage.

The prompt

Add this to your agent’s instructions so every remote it writes follows the rule:

Security rules for this game:
- The server is the authority for currency, inventory, damage and progress.
- RemoteEvents only carry requests ("buy itemId"), never results ("add 100 coins").
- Validate every remote argument with typeof and range checks.
- Look up prices and rewards on the server.
- Rate-limit remotes per player.
After writing a remote, list how an exploiter could abuse it and fix each one.

Audit what you already have

Find every RemoteEvent and RemoteFunction handler in this game. For each,
show what the client sends, what the server trusts, and how an exploiter
could abuse it. Then fix the dangerous ones.