It seems like this sort of questions is amazingly popular. I see two similar ones just in the first page here.

But I am so excited about this that I'd like to share my own situation and get some personal advice from you in this crucial first step.

Please :)
__________________

Maybe start out with Java and eventually port to C++, when game features and load exceed Java's performance limits?

Java will be fine for the type of game you suggest. You can probably use that with LibGDX for what you want. https://libgdx.badlogicgames.com/

Java will be fine for the type of game you suggest. You can probably use that with LibGDX for what you want. https://libgdx.badlogicgames.com/

What about code security? If I keep the game in Java, wouldn't people be able to read the code, clone the game, induce cheats?

They can do most of that with C++ too, it's just a bit harder, and requires different tools. It should be the least of your worries, to be honest. Most games will never be popular enough to inspire cheats. Any singleplayers that are popular enough don't matter, because the player is only cheating themselves. And if it's a multiplayer game, you would protect against cheating by other means (such as running the main game on a server, or by checking that all players are synchronised).

Sounds like Java is the way for you to go, if it's useful to you professionally then that's a big deal and Java will do the job just fine (do you know Minecraft was coded in Java?). As Kylotan mentioned, look into using LibGDX, it's a game library for Java.

Compiled code security is virtually a non-concern for the vast majority of applications for the vast majority of developers. And because Java is compiled (and so is C++) the original source code is not available to be read. Of course if you go and host your source on github then anyone can see it anyway.

And because Java is compiled (and so is C++) the original source code is not available to be read.

This is only partially true. You can decompile Java and get something very similar to the original source code. Obfuscating can help, but I don't know how well that works in practice (there are tools for de-obfuscating Java). C++ is, practically speaking, impossible to decompile. You can disassemble it, which could be enough for a cheater, but actually turning the executable back into working code is a huge task that I don't think any cheater will care to try.

You can disassemble it, which could be enough for a cheater, but actually turning the executable back into working code is a huge task that I don't think any cheater will care to try.

He/she doesn't need to, the disaasmbly shows the byte values of the program, so you can easily find that in the binary, and change the code by changing that to whatever instruction it should do instead.

You can decompile Java and get something very similar to the original source code.

Yes it is true that certain original symbols (e.g classnames and method names) are maintained in the compiled .class files and because Java maps pretty well to the underlying bytecode it means that decompiling bytecode to Java can produce a fairly faithful reproduction of the logic structure.

What I should have been saying is more along the lines of: Because Java is compiled to bytecode rather than interpreted from source, it means the original sourcecode including all symbols, comments, use of generics, etc is not shipped as-is to the client in plaintext for anyone to trivially read in their favourite text editor.

It's quite true that via decompilers you can get fairly workable code out of .class (or .dex) files. Which is much better than what you can get from say, a decompiler and a native lib, which basically will just declare a bunch of variables with register names, assemble something resembling a function declaration with a bunch of void*, and call it a day.

With that said, even if you're making a native game, you have to work out a way so the server can verify the information the client is sending. You can't rely in "oh it's a native file so users wont modify it!" and not check what the client is telling you. So whatever you chose, you'll have to do the legwork all the same and make up a scheme that lets you verify what the client is telling you.

Now if the game is single player, do you honestly care that much that people modify the game? Let them eat cake.