MetalBear built a browser-based Minesweeper game for marketing purposes using vibe coding, but left a critical security flaw: the server trusted the client's timestamps entirely. Nitzan, a security engineer at Daylight (a MetalBear customer), discovered that since the board seed and PRNG were exposed in public JavaScript, anyone could generate a perfect move sequence and submit it with a fabricated fast time. She responsibly disclosed the vulnerability and provided a regression test covering three cases: impossibly fast clears (must reject), legitimate fast human runs (must accept), and plausible claimed times with zero real elapsed time (must reject). The fix was straightforward: the server now records when it issued the seed and measures actual wall-clock time until submission, making client-claimed times irrelevant. A deeper issue remains — the seed still reveals the board layout — but the zero-second terminal exploit is closed.
