I’m working on a multiplayer android game with Unity. For server side I use python. There is no login system or username. Basically, there is a matchmaking system and rooms. I send json object which contains room key , position of user and etc. from client to server. Room keys are unique and 10 digit hexadecimal numbers. I use udp socket for communication. Here is my questions.

Is it secure only using udp socket for gameplay. Clients already has source code and can change it easily. So they can change data that coming from client to server. Do I need implement an algorithm to make more secure from hack or cheat? Can anybody change apk file and ruin everything in this game?