They can even report a Velocity of 0 while they’re moving, report a WalkSpeed of 16 while using 200, or report touching parts they aren’t touching.
In theory, an exploiter can change everything about their client, including removing and replacing your exploit-checking code but reporting to the server that everything is OK. Furthermore, they need to check only the position of the player, as almost everything else can be spoofed by the exploiter. To combat exploiting, all of your checks need to be on the server.
