another class of security issues that has been seen in other quiz apps is client-side disclosure of questions/answers, e.g., https://mentimeter.canny.io/feature-requests/p/make-sure-que...
I made sure to do all the important calculations server side, and only send the necessary data to clients.