Never trust the client. The browser should only render the graphics and capture user inputs. Game state calculations and score validation must occur entirely on the backend server. Implement Cryptographic Hashes (HMAC)
Loyal customers who played the game legitimately (visiting pubs, scanning coasters, earning 50 points per day) now feel cheated. Why bother walking to a bar when someone in a basement can earn a year’s worth of points in an afternoon? Pilsner Urquell Game Hacked