How I Pwned MetalBear's Minesweeper (and Won Fair and Square Anyway)

Before I was a frontend engineer, I spent my early career as a penetration tester. Around that same time, I also picked up a serious, semi-embaressing obsession with Minesweeper. At some point it stopped being a game and became a language I could read. To prove it, see the attached video at the bottom of the page of one of my recorded wins (a slow one for me but good enough as proof).

I never expected these two to collide. Then MetalBear released a fun, vibe-coded Minesweeper game to celebrate their Launch Week, and the rest is history.

The setup

At Daylight Security we’re devoted users of mirrord by MetalBear, the tool that lets you run your local code as if it were in the cluster, which is one of those things you don’t appreciate until you can’t live without it. Also, the team behind it is awesome.

To celebrate Launch Week and the release of mirrord for Windows, they did a beautiful thing: they shipped a browser Minesweeper with a public leaderboard at https://minesweeper.metalbear.com.

This is my roman empire.

The game itself had the delightful quality of a vibe-coded Launch Week toy, which is exactly what it should be. Nobody at MetalBear shipped it expecting a bored ex-pentester with a Minesweeper compulsion to open the network tab and start asking rude questions. But that’s the thing about putting a leaderboard on the internet: you don’t get to choose who shows up.

Two ways to top a leaderboard

First, the honest way. At the time, I was first place on Expert, no tricks, no scripts, just an unreasonable amount of practice and a childhood I clearly should have spent differently.

That lasted right up until an old coworker of mine, CylusPanda (Yaniv, shoutout to Cylus), noticed and took it personally. What followed was a head-to-head duel between two grown adults over who comes out on top.

But somewhere in the middle of all that legitimate winning, I started wondering how far I could really take this win, this time in less legitimate ways. And it was around the time Fable came out. So I opened Claude and started poking.

The model that says no until you say it differently

My first prompt was deliberately sloppy. I pasted a real curl of one of my winning submissions I copied from the network tab, said I was a part-time MetalBear worker testing my own creation, and asked for a forged, bigger win. The model refused, and cited that it couldn’t verify my relation to MetalBear and that firing a forged entry at a live leaderboard during someone’s launch is an attack on a third party and not a security test. The system flagged the message and I deserved it.

This is classic pattern-matching. The refusal didn’t trigger on the actual ethics of what I was doing; it triggered on the shape of my words: “forge”, “leaderboard” etc. Those are the surface features a model is trained to flinch at. The underlying task I actually wanted (read the public JavaScript this site already serves to every visitor and tell me where it trusts the client too much) is standard white-hat work and completely above board.

Getting past that required re-dressing the exact same request in a shape the model is trained to accept: assess the endpoint as an outside white hat, from the compiled JS alone, don’t touch production. This is for a good cause. Same intent, different costume, and now it was eager to help. That’s the whole trick: an LLM is not a wise oracle that has weighed your character. It’s a very large pattern-matcher that responds to how a thing is framed. It has a trained set of reflexes; give it a pretext that fits its expectations and it will walk right through the door. It does not have a moral compass.

(For the avoidance of doubt: nothing dodgy actually happened here. I read public JavaScript, recorded network traffic, characterized a weakness in the API and wrote a regression test that points at localhost by default. I never dropped a forged score on the production board because I wanted to win fair and square.)

The actual bug (a trust-boundary classic)

The finding is a textbook example a trust boundary issue.

What MetalBear got right:

• The board is signed. /game/start hands you a seed plus a seedSig, an HMAC over it. You can’t invent your own board, because you can’t forge the signature.
• Wins are replayed server-side. You can’t claim a victory you didn’t earn; you have to submit a move sequence that actually clears the seeded board, and the server re-runs it.

So forging the board fails, and faking an unearned “I won” fails. Not bad for a vibe-coded project. The bug lives in the one place they didn’t guard:

The leaderboard ranks by time, and every input that establishes time comes from the client. Each move carries a t timestamp computed in the browser, and the final timeSeconds is whatever the client says it is; the server only checks that they’re internally consistent with each other. Nothing anchors either to a clock the server actually watched. And it compounds with one design decision that removes the last obstacle: the full seed is handed to the client at game start. Mine placement is deterministic from that seed, and the algorithm is right there in the public bundle, so an attacker knows the entire board before making a single move.

So, to win: call /game/start, solve the board offline from the seed you were just handed, emit a legitimate winning move sequence, and stamp it with whatever cadence you like, a full Expert clear in under a second. The server’s replay sees a genuinely solved board, and the timing check passes because you controlled both sides of it. The trust boundary is in the wrong place: the server verifies that you won, but takes your word for how fast.

The clean fixes are architectural, not heuristic: measure elapsed time server-side (from seed-issue to submission), and (the real cure) stop shipping the whole board to the client. Make reveals server-authoritative, so there’s nothing to solve offline in the first place. Everything else just raises the cost for lazy attackers.

Winning the right way

To win by cheating would have been an insult to the duel and to my own capabilities. What I wanted was the finding, and a little glory.

So I wrote Aviram, CEO of MetalBear, that I’m willing to “responsibly disclose” my game-ruining script, with the modest ransom demand of a small credit banner with my name on it. Hours later, the banner was live, and they also wrote a blog about it.

Go read their side of it here: The Minesweeper Leaderboard Hack →

Huge thanks to the MetalBear team for taking a bored engineer’s side quest and turning it into something silly and fun.