Possibilities of cheating on online tournament.

Hello, im currently searching alternative for Tabletop Simulator because it have terrible security on player objects. (Everyone can see everything with memory dump)
Im interested in using vassal as platform for online tabletop tournaments, but not via email.
I have couple of questions, i will use this module as an example:
http://www.vassalengine.org/wiki/Module:Terraforming_Mars

Terraforming_Mars_101.vmod Module - en & fr 21.18 MB 2018-01-17 3.2.17 Setup_TM101_5players.vsav Saved Game - Setup 5 players 25 KB 2018-01-17 3.2.17
Does vassal use host - client system?
I hosted a game (Setup_TM101_5players.vsav) on first machine and then connected to it using second pc (load Setup_TM101_5players.vsav and connect via ip), my first player on first pc: black, on second: blue.
I pressed sync on blue client and grab a couple of cards in hand as black, then i save game as blue to cheat and watch which cards took black and I could not do it.
Is black hand in this save but program preventing to do it?
Is order of cards stored on host machine?
Is clients hand stored on host machine?
How can client cheat if he want to? (Potential, with memory dumps etc.)

Sorry for my bad english, not native language.

I already compiled engine with rewrite of visibility check and this is bad…
i play as blue and must not be able to see another player cards.
Screenshot in attachment.

Someone can help me figure out where i can disable synchronization for private window / delete objects in private windows from sync and hook when they not anymore in private window to implement more secure system?

You cannot protect any information from a knowledgeable attacker in vassal.