Last updated: 2026-08-20
If you have found a way to cheat a leaderboard, mint tickets, read someone else's data, or do anything the arcade clearly did not mean to let you do — we want to know, and we would rather hear it from you than find it in the database.
Email johnwowcool@gmail.com with the words SECURITY in the subject, or use the contact form. Tell us what you did and roughly how. You do not need a formal write-up or a proof-of-concept — “if you send this number to that endpoint it does something silly” is a perfectly good report.
A confirmed, genuine finding earns the 🐛 Bug Hunter badge and the ALPHA BREAKER title — neither of which can be bought, at any price, by anyone. They are granted by hand and only for this. You also get a numbered place in the list below, permanently, and a credit in the fix.
Stay inside that and we will treat your report as a favour, which is what it is. We will not come after you for a good-faith find — including one you already tripped over by accident.
Cheating in a game that only affects your own save or your own local best score is not a security issue and does not need reporting — half the fun of a browser arcade is opening the console. It becomes a real report the moment it touches a shared leaderboard, the ticket economy, or somebody else's account.
Nobody yet. Go and find something.
Every confirmed finding and what we did about it goes into the repository's security record, including the ones that were embarrassing. If you would like to see how the last one went, the short version is: one player, one number, fourteen minutes, and a leaderboard that took a week to trust again.