Well, lots of professional games couldn't even stop cheating, i would say nevermind this thing, it will take lots of your time and it's not worth it, you cannot stop cheaters if they wanted to cheat, but hey, in the end, who are they cheating? Themselves and no one else, Good luck
I disagree a little bit with Jazzzar -- on one hand, detecting and stopping cheating can be a lot of work. But if you have a shared leaderboard and the top 50 people always have a ridiculous score, it does take some of the fun away, so blocking some cheating is worthwhile in my opinion.
I think he's talking about someone cheating by adjusting the clock. Ie, start the game, play through until just about the end, then set your clock backwards to the moment just after you started the game, then complete the level. I think you effectively block this one pretty easily using alarms. GM alarms operate in room_speed ticks (steps) so use those to count your seconds rather than calculating elapsed time from the system clock. For example, do alarm[10] = room_speed; to count a single second, or just add 1/room_speed for every step in the game to county seconds. That should give you a real count on playing time.
Or if you want to DETECT time adjustments, then do something like that as well -- track the number of seconds using alarms or steps, then when you're done, calculate the elapsed time on the system clock. Compared this elapsed time to the number of seconds you tracked with alarms or steps. Allow a small grace period and flag cheating when there is a notable discrepancy. The one issue with this is if the game is paused -- for example, on a mobile device, if you switch to another app and then come back.
If you're talking about running on the PC and someone at runtime is hacking your speed to make it something that would not be allowed, Yal's solution is a good one -- basically figure out the quickest it could theoretically be completed and call them a cheater if they somehow went faster than that.
To help prevent cheating by hacking your save or ini files, don't use ini file for anything important. Instead use ds_map_secure_save and ds_map_secure_load to save and load your game status or save games. They work well, and well not insanely secure they will stop almost everyone from hacking save game data. This is also minimal effort to implement.
Oh yeah, to help prevent fraudulent IAP purchases -- make sure the user clicked your IAP buy button before a purchase is registered.