Chess moves are validated on the server with chess.js. Clocks, resign, draw offers, and timeouts use the same rules for player-versus-player and house games.
The house bot is a server-side engine with a published skill level and rating. It only sees a legal board. The level used is stored on the game.
Casino rounds commit a server-seed hash before you bet. After settle you can verify the HMAC. House edge is published on each table. Withdrawals take a 20% fee; deposits and pots do not.