---
title: "Nitzan from Daylight hacked our vibe-coded minesweeper"
url: https://daily.dev/posts/nitzan-from-daylight-hacked-our-vibe-coded-minesweeper-xxlzr0jkq
source_url: https://metalbear.com/blog/minesweeper-leaderboard-hack
type: article
source: "MetalBear"
published: 2026-07-08T18:21:05.593Z
updated: 2026-07-08T18:21:26.623Z
tags: ["security", "testing", "vibe-coding"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Nitzan from Daylight hacked our vibe-coded minesweeper

**[MetalBear](https://daily.dev/sources/metalbear)** · 3 min read · 0 upvotes · 0 comments

## Summary

MetalBear built a browser-based Minesweeper game for marketing purposes using vibe coding, but left a critical security flaw: the server trusted the client's timestamps entirely. Nitzan, a security engineer at Daylight (a MetalBear customer), discovered that since the board seed and PRNG were exposed in public JavaScript, anyone could generate a perfect move sequence and submit it with a fabricated fast time. She responsibly disclosed the vulnerability and provided a regression test covering three cases: impossibly fast clears (must reject), legitimate fast human runs (must accept), and plausible claimed times with zero real elapsed time (must reject). The fix was straightforward: the server now records when it issued the seed and measures actual wall-clock time until submission, making client-claimed times irrelevant. A deeper issue remains — the seed still reveals the board layout — but the zero-second terminal exploit is closed.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://metalbear.com/blog/minesweeper-leaderboard-hack>

## Similar posts on daily.dev

- [A Crypto Zero-Day Huntress](https://daily.dev/posts/a-crypto-zero-day-huntress-p5futpphr) · Medium · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#testing](https://daily.dev/tags/testing), [#vibe-coding](https://daily.dev/tags/vibe-coding)

[View this post on daily.dev](https://daily.dev/posts/nitzan-from-daylight-hacked-our-vibe-coded-minesweeper-xxlzr0jkq)