I am deving an android app, and i am planning to release it to Google Store when ready. In this app players have balances, i am using Firebase Realtime Database as my database at the moment, which has been serving me well.
I am just wondering that how easily can this kind of code be exploited? Lets see an example:
Here is a really simple write to a user's balance section in Firebase database:
Code (CSharp):
dbreference.Child("Players").Child("someplayername").Child("Balance").SetValueAsync(2000);
How bad is this code in terms of security? Can someone "dig in" to this .apk app and simply edit that to a value of their own? I know i could do this balance add in the back end, but still there has to be SOME value sent from the users client, even if it was a simple ON/OFF boolean, and the back end would handle the rest...