The goal is not an unbreakable client. That does not exist. The goal is that breaking it gains nothing that survives contact with the server.
Nothing valuable is decided on the device
If the client computes a score, a reward or a balance, treat it as a suggestion. The server recomputes or rejects.
Validate the physics of the claim
A score that implies inhuman input speed, a session shorter than the minimum possible, a hundred wins in a minute - these are cheap checks and they catch most automated abuse.
Watch the exit, not just the entrance
- Payout velocity per account and per device
- Many accounts sharing a device fingerprint
- New accounts reaching a threshold unusually fast
Log what you rejected
Rejections are your early warning. A sudden spike in one failure type usually means someone found something new.
