Say I was making a character creator/customiser, where the player can choose their hair, hats, clothing etc. on the client/localscript. If I were to call a RemoteFunction to check if they had a certain gamepass (for example one which unlocks exclusive hats), I would return either true or false into a variable. My question is, would the client be able to change this variable after it's been returned, (so false to true), so they can access the exclusive items without having the gamepass?
Secondly, what would be the most ideal place to store experience and currency on the server, so it's not accessible or able to be changed by the client, (e.g in Players Service, Repstorage, workspace etc.)?
Thanks.

2 comments
The remotefunction calls to a serverside script, which then checks if the player has the gamepass, it's just if they can changed the returned value or not?
as I said, they can and they will as long as it's a localscript.