Today we secured the game from the ground up: we locked down the old Firebase database, removed the exposed PIN system, moved the leaderboard to a fresh Cloudflare D1 database, and put a Cloudflare Worker in charge of registrations, usernames, cooldowns, random rolls, and score saving. Players can’t submit their own scores or edit someone else’s, duplicate usernames are rejected, sessions are protected with secure cookies, and the Worker now checks requests properly instead of trusting the browser. We also cleaned out the old Firebase code, updated the README, pushed everything to GitHub, and fixed the bug that was making rolls fail with a 503 error.