To understand how Blueberry security works, you have to be familiar with the difference between client-side and server-side scripts.
It is well known that exploiters have almost full access to the client-side of the game. So they can easily edit, read, change, etc. everything that is client-sided, without the server noticing. What they change about their client can only be noticed by using a client-side script.
Blueberry's punishment screens are client-sided (the ScreenGui elements can only be client-side), meaning that exploiters could just delete them and bypass the punishment, right?
Version 1.01 - 1.02:
Well, not quite. Exploiters can indeed try to remove their punishment screen, but we made sure to add several 'security checks' in the system. Whenever an exploiter tries to remove or modify a local element belonging to Blueberry, several checks will take action and remove the suspect.
But can't exploiters just delete the 'checks' since they are client-sided? Obviously, they can. But there is not only one single check, but several, and each check is dependent by the others. Meaning that, if an exploiter removes one of the checks, the other ones will know and remove the exploiter.
Concluding, if they try to remove or disable the checks, the other ones will take action without the exploiter having enough time to disable all of them. We consider Blueberry safe enough to use and we will improve the system security if we notice that exploiters have a way to bypass it.
Version 1.03 and up:
We have removed the client-side checks in newer versions of Blueberry because they weren't as efficient as we wanted them to be, and also because we received several reports that the system errored sometimes because of the parent changes.
Therefore, we removed the client-side checks, leaving only one script in the client-side. The rest will be handled by the server. The suspect's character is being unspawned on join and their chat access is being suspended. The system will check every 5 seconds if the suspect's character exists or not. If it does, then it will proceed to remove it again.