Hey,
I've tried your Llama Legends game. Well done.
Here's your QA report in a Google Sheet, you can find it here: https://docs.google.com/spreadsheets/d/18I9cPYGeRW33GBd-vkZXnGhcQcKT2PUMvZtvcuA8...
A quick note on OBS-004 (autoclicker vulnerability), I recorded a short demo showing the click loop being exploited with no resistance. Took me 40 seconds to set it up. You can view it here: https://drive.google.com/open?id=1Ln67qOjyGrCyX7DL2gDRxIJNugfm6-_m
I also want to flag a few additional issues I noticed around the login and cloud sync flow:
On first visit, the game prompts you to enter a name even if you are a returning player, which is confusing.
Pressing "Sign in with Google" registers a new user rather than logging in, the intent of the button is not what it does.
The login form language is unclear: "Connect now" means sign in, but that is not obvious.
Cloud sync does not appear to work, signing into the game from a different browser creates a new character and the previous progress is lost entirely.
Looking forward to playtesting again later! If this was on mobile I would probably play it as a side game. The game has got some potential to make some money as well, but you have to move from browser to mobile.
I hope this information helps you. 🙂
Best of luck,
Remi