Both Ultralight EV1 and NTag 21X are supported and recommended. Cloning is possible for the NTag, but there’s currently no chip out there that can actually lock block 0, which makes detecting and bricking them trivial.

One can make this system as secure as the specs require it to be: brick clones, reject certain tag types, add encryption, add counters, perform analysis server side, etc.