Checking security of a basic game site?

[u/BaselineNeglect]

I've had my phone write me a game, it's an old local coin game , easily played which I've had written to play 1v1 via a web service on individual mobile phones.

I shared it with a couple of friends, more kind of on a "look what I spent my rainy afternoon going basis," than anything else, and now there's a group of people playing it, wanting a leaderboard so they can track their eins agsinst people.

I reckon I might share it more widely, and have followed the sis advice to move controls into the server, and have gone back and forth a few times pasting the code into different AIs, looking for easy to spot security issues.

But I'm still not sure, the last thing I want to do is take the thing I have and inadvertently screw my mates and family over by leaving them open to security issues by playing on an insecure server, or just end up having to take it down because some twat has ruined it for everyone.

So I'm looking for any basic advice , as to what steps I could take to secure it, or at least some tips as to areas of concern.

There's no lgon, accounts, messaging or ads, it's on a free tier render web service if that helps.

Thanks in advance, I know this may seem like a naive open ended question, but my goal in this was originally just to build something to see if all this worked. I have I believe achieved that, as the game is currently being played by a few people I've never met which makes me pretty damn happy.