Sorry if this question is silly, I'm still learning.
My smart contract has a function which mints a token and is owned by the caller. I set it as public so it can be called externally through web3js. My game calls this mint function every time you beat a level. However, because it is a public function, is it true that someone can simply call this function without beating the game?