The bullet may not actually matter. The safest way to design such a system is giving full authority to the server. This means that only the server simulates critical events, such as damage or death.
The bullet and shooting effects may just be for show on the client. The downside of this is that it may produce some odd effects in laggy environments, but the end user shouldn't be playing a shooter in a laggy environment anyway.
It's also worth considering that the user will expect immediate feedback when they shoot a gun. So it makes sense for that client to create their own shooting and bullet effects. But everyone else's projectiles are created only on the server's instructions.
Client validates the conditions for shooting locally, and if they are fine it will create the bullet and play the shooting animation. At the same time it sends a request to the server, which then validates again. If everything is fine the server relays the shooting command to everyone. If anyone is subsequently damaged by the projectile, the server alone makes that decision and informs all of the clients of the outcome.
Keep in mind you'll need to integrate prediction for this sort of solution to be satisfying.