The golden rule: never trust the client
Everything on a player’s device can be read and modified by that player. The entire discipline of Roblox anti-cheat is one sentence: the server decides, the client only asks. Damage calculations, currency grants, teleport checks and purchase confirmations belong in server scripts; the client reports intent ("I pressed attack") and the server validates feasibility ("was the target in range? was the cooldown ready?").
The classic exploits and their fixes
Fly/speed hacks: server-side position validation (distance moved per tick beyond a threshold flags it). Currency duplication: all currency changes through server functions with sanity checks. Remote-event abuse: every RemoteEvent handler validates arguments (a client sending "give 999999 coins" is rejected — the server decides grants). Filtering enabled made the client-server boundary real; respecting it is the whole defense.
Detection over prevention
Some exploits cannot be prevented (clients control their own inputs), only detected: impossible speeds, impossible resource rates, statistical outliers. Log the evidence, then act — silent flags, shadow mitigation (server ignores the impossible action) or moderation reports depending on severity. Publicly accusing players from imperfect detections creates more damage than the exploit.
