question

Paying attention to how you manage your data security is always a good thing, but I'm not clear on what your specific question is. Any general-purpose computing device is vulnerable in the way you describe - if the app or game in question uses a server, the data being sent to the server can be changed. And even if you try something like encryption (above and beyond the SSL protection you already have), all the hacker has to do is change the data in-memory, before you encrypt and send it. For any popular game, it's not even a question of technical proficiency - hackers will post hacking tools online that require zero technical knowledge to use.

The best way to think about it is this: What level of security do you need for your app or game?

If there's minimal risk, don't worry about it - yes, players will cheat, but if there's nothing they get out of that like a prize (in-game or otherwise) or leaderboard ranking, it doesn't really matter.

If you need some, but don't require a high level of security - just checks on things like min/max scores, that the player isn't reporting results more often than is possible, etc. - you could have the client send its information to Cloud Script, and have secure, server-authoritative code there that checks for cheating.

If you want your game to be highly secure, you'll want to use a custom game server, and have it run the parts of the simulation that need to be secure, with the client providing inputs that you can check with any server-side security logic you like.

Also, at the simplest level, we recommend:

1. Profile your game and, prior to launch, using our Permission Policies (https://blog.playfab.com/blog/permission-policies) to turn off all the Client API calls you're not using.

2. Choose which data type you use based upon the level of security you need. Use read only data for things you want the client to be able to read but not update (you update it through Cloud Script or a server). Use internal data for things you don't want the client to even be able to see (like tracking on potential cheating).

3. Don't turn on the API calls we have off by default (have a look at the Settings->API tab). Things like Virtual Currency and Statistic changes will absolutely be cheat vectors if you expose those.