Exactly, all security will have to be handled by a combination of Back end server code and also encrypting the traffic to the user with HTTPS so that the packets cannot be easily opened or tampered with.
Construct 2 builds games in javascript and HTML5 which has no intrinsic security of its own. The security is provided by the server and any encryption methodology you choose to use.