What about instead of storing the data under their username or twitch ID, assign them a randomly generated userid. Then you have the javascript send the bits information with the userid. If the received userid doesn’t exist in your system, you know it’s fake. No one should know another person’s userid.
1 Like