Security
Accounts
Scoring, teams, graphics and dashboards need login. Passwords are hashed.
CSRF
Score and admin forms check a session token.
Ownership
Users can edit only their matches and tournaments. Admin can approve scores.
Data files
JSON data under /data is blocked from direct web download.