Hueflip is a one-board-a-day puzzle: tap a card and it flips together with its four orthogonal neighbours; reproduce the target design in the fewest moves and the fastest time. Everyone gets the same 5x5 board (rolls over at 00:00 UTC) and one attempt, then there's a daily leaderboard. Free, in the browser, no signup needed to play. English and Spanish.
A few of the design problems that turned out to be more interesting than the game itself:
Cheat resistance without a real game server. The board is generated deterministically from the date plus a per-day salt, salt = HMAC(secret, date). Opening the board is a POST that records a server timestamp and returns the salt; you can't generate today's board without it. On submit the server replays your presses against the same generator and computes the score itself, and measures the duration from the timestamp it recorded. The client never reports a time or a score. Yesterday's salt becomes public so past boards can be replayed for practice and rendered on the archive pages.
Play first, sign in later. Every visitor gets a Firebase anonymous session, which is enough to register a real attempt. If you finish as a guest your score is saved under a generated name; signing in with Google later links the anonymous account, keeping the uid, so the run and streak survive. Anonymous starts are rate-limited per hashed IP so an incognito window isn't a free retry.
Fairness vs. hints. Hints are the only way a card ever gets highlighted on the ranked board, they're recorded server-side and cost 15% of the score each. The first one is free.
Stack: Angular 22 with signals, Tailwind 4, Firestore for reads, Vercel functions for every write, installable as a PWA. No SSR; the archive pages are indexed from the rendered SPA.
Things I'd like opinions on: whether one attempt per day is the right call (it makes the leaderboard honest but it's brutal for newcomers), and whether the scoring weight between moves and time feels fair. Happy to answer anything about the anti-cheat side.
