✓ Accepted answer
Players can change, copy, download, anything on their client.
What they do locally does not replicate on the server, for the exception of the character, so changing walkspeed, jumppower, and things like this on the client change the way the humanoid moves and is seen by everyone in the server. Even if the server can't detect when those values are changed on the client.
So for tools, what is done on the client (like creating a tool client-side) does not show on the server. For the server it will be like nothing happened, HOWEVER, exploiters are able to run animations, and those will be seen by everyone in the server.
So in short, character modifications applied on the client are shown on the server. To do anything else exploiters need to use remoteevents/remotefunctions (this is why remoteevent security is important).
Even if they can just modify the character, that allows them to create a lot of damage. For example they can fling everyone by making their character spin very fast. Or they can become invisible. Or stuff like this.
2 comments
They can also do all kind of other modifications client-side, such as aimbot, ESP.. anything that either modifies their own character, or modifies the game CLIENT-SIDE.
Hey thank you! I needed this!