question

Well first, please make sure that you're only exposing profile data (Settings->Client Profile Options) which you want everyone to be able to see. The player's display name is the only thing that's returned by default, so if you do nothing else, that's all they'll get (along with each player's statistic for that leaderboard).

Now, since our service is Web API based, and you have to be able to let players sign in, it will always be possible for a hacker to create a player account and use the API calls you use in the game. But as a best practice, you can turn off 100% of the API calls you aren't using API Permission Policies (https://api.playfab.com/blog/permission-policies). So, for example, if you have a game that requires Steam login, you can block every other form of login by only allowing the Steam login API call.