One worry might be the impact on the quality of gameplay. Like bruh, which skrub likes doing validation before every run? So another idea you might want to add to minimize effect on gameplay is to only bring up the passcode in the first place if the player makes repetitive/bot-like movements. ReCaptcha does something similar in some sites, where if you seem human enough it doesn't even make you do the tiresome validation in the first place.