Did you create an admin portal to spot bad actors?
I did. I can see who is:
Trying to game the system;
Trying to earn more NIM without using the app;
Trying to call my backend without approval, etc.
Because your app is vibe-coded and involves money transfers, I would advise you to tighten up security and build an admin panel to spot bad actors visually. The admin panel shouldn't just be about analytics or who is using the app. When real money is involved, security is a priority.