[b00gn1sh]

Yeah, this is the part of building browser games that's quietly gotten harder in the last year. I've been working on a Quake III conversion that runs in the browser and I keep bumping into versions of the same problem. Anything the client knows, an agent knows in about five minutes now.

The weird thing is the fix (make the server authoritative) is 90s MMO wisdom, it just used to not be worth the effort for a small game with no money on the line. Now the cost of a bot attempt is basically zero so every game inherits the threat model of a game that does have money on the line, whether you want it or not.

The leaderboard-split thing OP ended up doing is probably the right call for a lot of these. Fighting it is a losing battle when one person with Claude and a weekend can out-iterate you.