Keep TYPESAFE_API_KEY server-side. The included server binds to loopback and is a development tool, not a public gateway. Validate player authorization, rate-limit calls, enforce body limits and use TLS before remote deployment. Report vulnerabilities privately through GitHub security advisories.