I have a couple GUIs that I made and they're at the moment stored in the replicated stored. I was wondering for against exploiters if the GUI is fine to stay there or if it should scripted it self or if I should store it in the server storage and use a remote event to transfer it.
EDIT: Forgot to mention that the GUI is for a menu which a player needs to click on something for it to pop up and I'm not sure if an exploiter could modify the GUI details inside replicated storage
It is irrelevant, either it's stored somewhere the client can locate it at, and therefore so can an exploiter, or it's stored in the server and no client (or exploiter) has access to it.
Don't try to stop exploiters from the client, they are able to do everything you can do with a localscript and more, under most circumstances. Instead, focus on working your server to only accept proper remote input. Planning out game logic is a lifesaver.
TL,DR; Doesn't matter all that much, unless the client literally can't access it (ServerStorage).
Okay. Usually what I do is place them in ReplicatedStorage just for the sake of performance. Then when the player joins, I clone the gui to the PlayerGui using a localscript.
Well, that was a good question and I hope I helped.