Client is sent a complete copy of initialState

[Jim-with-a-J]

(warning: this is the first time I have used boardgame.io, and also the first time I've used javascript for a personal project, do not assume basic competence)

I made a very simple game with secret state (a draw pile and players' hands). I added the playerView method to filter out the unwanted state, but if I check the network log, the entire starting state is sent to the client as "initialState". This would allow a player to cheat by seeing what cards their opponents started with or would draw next.

How is this normally handled? Is there a way to filter initialState before it is sent to the client, or should I use the unshuffled deck as the initial state and somehow handle the shuffle and deal after the game has started?

I searched through the docs and past issues and only found one mention of this saying "we should handle this via playerView like regular state", but I tried to figure out how this could be done and quickly ran into something to do with Redux, which I know nothing about.

[Jim-with-a-J]

After re-reading the docs, I think the only way to handle this is to use the unshuffled deck as the initial state and add an initial phase to actually shuffle and deal the cards to the players. I think it might be worth documenting this in the secret state chapter though, since it's easy to overlook that initialState message when testing.