OnClientEvent is there a security risk

[lilac ridge]

Only if it's fired first

Use the function then delete it and remake it under a new name like Remote1 delete and remake it to Remote2 on and on each time it's fired

[kind stream]

In almost every case exploiters can easily fire remoteevent
You need to do a secured server script