roblox-luau Checked

local coins = Instance.new("IntValue")

coins.Name = "Coins"

coins.Value = 0

coins.Parent = stats

stats.Parent = player -- parent LAST

end

Players.PlayerAdded:Connect(onPlayerAdded)

### 2. Create and configure an instance

local Workspace = game:GetService("Workspace")

local part = Instance.new("Part")

part.Size = Vector3.new(4, 1, 4)

part.Position = Vector3.new(0, 10, 0)

part.Anchored = true -- won't fall under gravity

part.BrickColor = BrickColor.new("Bright blue")

part.Parent = Workspace -- set Parent last so it replicates once, fully

### 3. Connect an event (and disconnect to avoid leaks)

local debounce = false

local connection

connection = part.Touched:Connect(function(hit: BasePart)

local character = hit.Parent

local humanoid = character and character:FindFirstChildOfClass("Humanoid")

if not humanoid or debounce then return end

debounce = true

humanoid.Health -= 10

task.wait(1) -- task.wait, NOT the deprecated wait()

debounce = false

end)

-- Later, when the part is removed or the round ends:

-- connection:Disconnect()

### 4. Client → server with a RemoteEvent (validate on the server!)

-- ReplicatedStorage: create a RemoteEvent named "BuyItem" (in Studio or via code).

-- CLIENT (LocalScript): request a purchase. The client can lie — this is only a request.

local ReplicatedStorage = game:GetService("ReplicatedStorage")

local buyItem = ReplicatedStorage:WaitForChild("BuyItem") -- wait: may not have replicated yet

buyButton.MouseButton1Click:Connect(function()

buyItem:FireServer("sword") -- send the item id only; never the price/result

end)

-- SERVER (Script): the ONLY place the transaction is decided.

local ReplicatedStorage = game:GetService("ReplicatedStorage")

local buyItem = ReplicatedStorage:WaitForChild("BuyItem")

local PRICES = { sword = 100, shield = 75 }

buyItem.OnServerEvent:Connect(function(player: Player, itemId)

-- TRUST NOTHING from the client. Validate types and values.

if type(itemId) ~= "string" then return end

local price = PRICES[itemId]

if not price then return end -- unknown item

local coins = player.leaderstats.Coins

if coins.Value < price then return end -- can't afford

coins.Value -= price -- server applies the change

grantItem(player, itemId)

end)

### 5. A per-frame loop with RunService

local RunService = game:GetService("RunService")

-- Heartbeat fires every frame AFTER physics; dt is seconds since the last step.

RunService.Heartbeat:Connect(function(dt)

spinner.CFrame *= CFrame.Angles(0, math.rad(90) * dt, 0) -- 90deg/sec, frame-independent

end)

### 6. Shared code in a ModuleScript

-- ReplicatedStorage/GameConfig (a ModuleScript) — usable by server and client.

local GameConfig = {}

GameConfig.MaxHealth = 100

function GameConfig.damageFor(weapon: string): number

return ({ sword = 25, bow = 15 })[weapon] or 0

end

return GameConfig

local GameConfig = require(game:GetService("ReplicatedStorage"):WaitForChild("GameConfig"))

print(GameConfig.MaxHealth)

## Pitfalls

- **Trusting the client is an exploit** → clients can send any arguments to a
  `RemoteEvent`/`RemoteFunction`. Validate every argument's type and range on the
  server and keep the server authoritative over health, currency, and inventory.
- **`LocalScript` doesn't run where you put it** → LocalScripts run in
  `StarterPlayerScripts`, `StarterCharacterScripts`, `StarterGui`, or tools — not in
  `Workspace` or `ServerScriptService`. Server `Script`s belong in
  `ServerScriptService`/`Workspace`.
- **Deprecated globals** → use `task.wait`/`task.spawn`/`task.delay`, not the old
  `wait()`/`spawn()`/`delay()` (worse scheduling and throttling).
- **Parenting first, then setting properties** → set properties first and `Parent`
  last so the instance replicates once in its final state.
- **`nil` on the client right after join** → objects stream/replicate over time; use
  `parent:WaitForChild("Name")` instead of indexing directly on the client.
- **Connections never disconnected** → long-lived `:Connect` handlers leak and can
  fire on destroyed objects; store the connection and `:Disconnect()` (or use
  `Instance:GetAttributeChangedSignal`/`:Once` where appropriate).
- **Using a RemoteFunction where a RemoteEvent fits** → `RemoteFunction` blocks
  waiting for a return and a malicious/slow client can stall the server; prefer
  one-way `RemoteEvent`s unless you genuinely need a reply.
- **Assuming the old type checker** -> Luau's New Type Solver reached general release
  (out of Studio Beta) in Nov 2025. `nocheck`/non-strict places get it automatically;
  strict-mode places opt in with the `UseNewLuauTypeSolver` workspace property, and
  `LuauTypeCheckMode` sets a place's default checking mode. It runs only at edit time
  (no runtime cost), so triage type warnings against the solver the place actually has
  enabled, not older behavior.

## References

- For the full client/server model (replication, `RemoteFunction` vs `RemoteEvent`,
  `:WaitForChild` timing, `BindableEvent` for same-context messaging, attributes,
  `CollectionService` tags, and `:Once`/connection cleanup), read
  `references/client-server.md`.

## Related skills

- `roblox-datastores` — persist player data across sessions (server-only).