I shipped a client-side leaderboard and chaos ensued

chaos did not actually ensue, but did i spend the next 24 hours trying to secure it. here's what i learned.