Section 10: Every Leaderboard Is an Invitation - Anti-Cheat, Integrity & Reliability

Executive Summary: A leaderboard that pays rewards attracts people who'd rather edit a number than earn it. The integrity layer is a funnel: cheap checks on every run (signatures, a server-signed run ticket, runId dedupe, rate limits, a 2,000 points-per-second plausibility bound), and expensive replay validation only for runs that would enter the visible top 1,000, held provisional for at most 15 minutes. Shadow bans and removals work because Redis is a projection of the log. The failure matrix then shows each failure degrading one path, with board recovery bounded at 10 minutes.

The Client Is the Attacker's Computer

Every number in a POST /v1/runs body comes from a phone the player owns, which they can root, debug, or bypass entirely with curl. So open with this:

You: "The client is untrusted. Everything it sends is a claim, and the server's job is to decide how much to believe it."

The first layer is a signed run summary. On install, the client registers the public half of a per-install key pair. Each summary is signed with it: runId, score, durationMs, endedAt, the run's seed and a compact input trace.

Interviewer: "So signing solves cheating?"

You: "No. The key lives on a device the cheater controls; with a rooted phone and a memory dump, they can extract it and sign anything. Hardware-backed keystores and attestation make that harder, not impossible. What signing buys is narrower: an edited curl body fails, a summary lifted from someone else's install fails, and a compromised install can be revoked on its own. Signing proves the run came from an install we registered. It never proves the score was earned. The defenses that matter run on our servers."