So let's say your user sends a transaction, your script gets the receipt (getTransactionReceipt), checks if everything is fine and then does something. Can't people just rewrite your scripts in developer console and send fake data?
For example: Bob needs to pay 1 ETH. Can't he just fake his address (of someone who already paid you the same amount) or use someone's transaction id or maybe when at the end your JS sends data to your server to recheck the transaction he could send fake address/transaction id?