I shipped a client-side leaderboard and chaos ensued (basecase.sh)

chaos did not actually ensue, but did i spend the next 24 hours trying to secure it. here's what i learned.