Serversided Leaderboard is open for exploiting? [closed]

Hello,

I have started making a tapping simulator sort of game and it is going well,

I recently tried to exploit my game to test out if it would work. For this instance I gave myself Taps which you can buy Rebirths with taps, I gave myself around 1 billion taps and for some reason, it worked. My scripts are serversided.

Here is my leaderboard,

local dataStoreService = game:GetService("DataStoreService")
local tapsData = dataStoreService:GetDataStore("TapsData6")
local rebirthData = dataStoreService:GetDataStore("RebirthData6")
local rebirthpriceData = dataStoreService:GetDataStore("RebirthpriceDataStore6")
local multiplierData = dataStoreService:GetDataStore("MultiplierDataStore6")

game.Players.PlayerAdded:connect(function(p)
    local stats = Instance.new("IntValue")
    stats.Name = "leaderstats"
    stats.Parent = p

    local taps = Instance.new("IntValue")
    taps.Name = "Taps"
    taps.Value = tapsData:GetAsync(p.UserId) or 0
    taps.Parent = stats


    local rebirths = Instance.new("IntValue")
    rebirths.Name = "Rebirths"
    rebirths.Value = rebirthData:GetAsync(p.UserId) or 0
    rebirths.Parent = stats


    local rebirthprice = Instance.new("IntValue")
    rebirthprice.Name = "Price"
    rebirthprice.Value =  rebirthpriceData:GetAsync(p.UserId) or 100
    rebirthprice.Parent = stats

    local clickmult = Instance.new("IntValue")
    clickmult.Name = "Multiplier"
    clickmult.Value = multiplierData:GetAsync(p.UserId) or 1
    clickmult.Parent = stats
end)




game.Players.PlayerRemoving:Connect(function(player)
    tapsData:SetAsync(player.UserId, player.leaderstats.Taps.Value)
    rebirthData:SetAsync(player.UserId, player.leaderstats.Rebirths.Value)
    rebirthpriceData:SetAsync(player.UserId, player.leaderstats.Price.Value)
    multiplierData:SetAsync(player.UserId, player.leaderstats.Multiplier.Value)
    print("saved data")
end)
--this is a huge mess :/

I know it's a mess

EDIT: I fixed it, found out the buy script was local and calling a remoteevent through a local script. If you have this problem make sure your scripts are SERVER SIDED