How to secure RSPS voting callbacks

Callback endpoints should use HTTPS, validate credentials, reject malformed player names and prevent the same vote from being rewarded twice. Return a clear success response only after the reward has been recorded.

Do not trust URL parameters alone

Use the credentials shown in the RuneTopic integration panel and compare secrets with a timing-safe function. Restrict database permissions and keep credentials outside the public web root.