Game aggregator security checklist for operators
Callbacks, credentials, rollbacks and rate limits you should verify.
Protect credentials
Keep API tokens server-side only. Rotate them after staff changes and never embed them in client apps or public repos.
Harden wallet callbacks
Validate signatures, enforce idempotency on bet/win, and handle rollbacks so a failed round cannot double-credit a player.
Abuse controls
Apply IP allowlists where possible, rate limits, and session spend caps — especially on demo and staging environments.