How can I use RemoteEvent keys to prevent exploits from taking advantage of remotes?

So I know some games use keys for RemoteEvents are passed each time the event is fired, for the event to work, or it will kick you or simply not run.

I was thinking about how to implement this, and knowing that some exploits can actually listen in on the event arguments, it would have to change each time the remote fires for maximum security.

Also, how would I let the client know what the key was? How is that possible?

Any help on the best way to do this would be greatly appreciated! Thanks in advance.

I don't know a lot about what exploits are out right now, but I do know that they can pretty much read all the scripts that are replicated to them. So even if you make a password, and have the client send that password through the remote event, the exploiter can read what password you are sending in normally and use that to send their own stuff.

A solution to this is simply implementing security checks on the server side.

For example, say you have a remote event to fire a bullet from your pistol. If it was unprotected, an exploiter could spam that event and fire a bunch of bullets even if they didn't have a pistol.

However, if you checked on the server side:

1. Does the player have a pistol and is it equipped?
2. Does the pistol have ammo remaining?
3. When was the last time this event was fired?

There would be no way for the player to fire the bullet unless they had a pistol, ammo, and waited at least the correct interval of time between each bullet. But if this was the case, firing the remote event wouldn't be much of an exploit, because they could achieve the same thing by simply firing the gun normally.

I hope this gives you an understanding of how to protect your game from exploits!