With Filtering Enabled on, and a LocalScript firing a gun, is it safe, can they modify it in someway? If so, can they modify the script to change values that are determined inside like damage, or the wait time for a reload, etc? Or is it safer to transfer the mouses hit through an event and fire it through a Script, server-side?
It's always safer to run it Server-sided with FilteringEnabled and then using a RemoteFunction so it returns back the information to the server.
Basically, you need to fire up the LocalScript Server-sided, for the exploiters not to be able to exploit anything from your gun, altought that might produce some delay in the firing of the gun. So you will have to play a bit with it so the delay is less noticed by the users.
It is safer to run it server-side as Filtering Enabled stops exploits from being able to edit server scripts, but not local scripts.