Just wanna mention it, this is bad scripted.

The Javascript vars are global, so there is no closure function around it, so you have accsess to them.

You can read them out, so you know all the cards, and you can even edit them (client-side) but anyway, the hard bug here is that you can read them