Development retrospective
Moving critical rules server-side
The security and reliability pass behind accounts, rewards, saves, and live web builds.
A browser is an untrusted client
As accounts and rankings became meaningful, critical calculations could no longer rely only on code delivered to the browser. Reward checks, account spending, and progression rules began moving behind server endpoints.
Loading must fail clearly
The web build gained a boot gate so required data is available before play begins. We also fixed live XP-table loading and improved error paths. A blank or half-ready game is worse than a short, honest loading state.
Protecting the player
Server-side checks are not only anti-cheat measures. They prevent double spending, inconsistent saves, and accidental corruption when a request is repeated or interrupted.
Security as maintenance
Obfuscation can slow casual inspection, but it does not replace authoritative validation. The long-term work is keeping inputs narrow, responses explicit, and public documentation separate from private implementation details.