Never trust client input for:

• role
• score
• objective completion
• elimination
• vote result
• evidence manipulation
• qualification
• winner calculation

The Impostor ID must never be broadcast to all players.

Bad:

{
  players: [...],
  impostorId: "player-04"
}

Correct:

Server
 ↓
Check authenticated player
 ↓
Return only information authorized for that player

Do not allow:

POST /objective/complete

with:

{
  "completed": true
}

Instead, the server must verify the actual game condition.

Every Impostor action checks:

• player identity
• player role
• player alive status
• game phase
• target validity
• ability availability
• usage limit
• cooldown
• mansion membership

The server verifies:

• player is alive
• meeting is active
• player belongs to the game
• player has not already voted
• target is eligible

Admin routes require separate authorization.

Admin actions such as:

• role reveal
• forced elimination
• score adjustment
• round reset

must require elevated permission.

Never commit:

DATABASE_PASSWORD
JWT_SECRET
SESSION_SECRET
ADMIN_PASSWORD
API_KEYS

Use environment variables.

Rate limit:

• login
• registration
• voting
• game actions
• WebSocket connections

Record:

Admin login
Role assignment
Evidence changes
Elimination
Votes
Score changes
Round changes
Admin overrides

Never place sensitive information in:

• public environment variables
• HTML
• local storage
• browser-visible configuration
• global WebSocket events

Use:

• authentication
• least-privilege database users
• encrypted connections
• backups
• production/private network rules

Use secure, HTTP-only cookies where appropriate.

Configure:

Secure
HttpOnly
SameSite
Expiration

Anything the player should not know must never be sent to the player's browser.