Local save files are controlled by the player and can be edited.

JSON is not security.

Obfuscation or encryption may discourage casual editing, but the client still contains the logic and keys.

For offline games, validation is often enough.

For competitive or valuable online data, use a server-authoritative system for:

• premium currency;
• rankings;
• purchases;
• valuable inventory;
• shared progression.