Completely offload all your data to an external server that handles all the user data, leaderboards, etc. Have users sign in with their user id and hash that in a secure firebase storage that can only be accessed by the backend. Once you’ve completed these steps, to make sure there is no cheating you need to keep saves of all the data (almost like an audit log) and decrypt code.org’s tokens to determine whether or not the user is signed in. Implement either a JWT encryption system (the most likely for a code.org project) or use AES keys to securely send data from the server to the frontend.
