ServerScriptService

ServerScriptService is a container service for Script, ModuleScript and other scripting-related assets that are only meant for server use. The contents are never replicated to player clients at all, which allows for a secure storage of important game logic. Script objects will run if they are within this service and not Disabled.

This service houses just one property, LoadStringEnabled, which determines whether the loadstring function in Luau is enabled. It's recommended to keep this disabled for security reasons, as misusing this function can lead to remote code execution vulnerabilities.

Scripts running in ServerScriptService may need access to various other assets which are not scripting-related, such as prefabricated models to be cloned. Such assets should go in ServerStorage, which behaves similarly to this service except that Script objects will not run even if they are not Disabled. Assets and ModuleScript that are useful to both the server and clients should go in ReplicatedStorage instead. Finally, you can further organize objects within this service through the use of Folders without affecting the way it behaves.