[Yen]

Take away edit attributes, problem solved.
clientr. is the most hack-proof you can get.

player. variables already exist, but they're just like a global variable attached to the player's client; any NPCs can read them from the clientside.
Or maybe they don't exist, so they take on the characteristics of a variable with no prefix. Who knows?