Developer Builds Browser Game Entirely Through Prompting Claude for LittleJS Jam

·4 views

A developer set out to create a complete browser game using only Claude, without separate AI image or music tools and with minimal manual coding. The project was entered into LittleJS Jam 3, a competition that accepts AI-assisted coding and asset creation and requires the LittleJS framework and the theme keyword "zig-zag." The game, called "Zig-Zag Heroes," is a one-dimensional survivors-style shooter controlled by two buttons, with inspirations drawn from Vampire Survivors and One Finger Death Punch. Claude produced the initial mechanics and even built a scripted bot that played the game to gather statistics for balancing. The developer also used a custom pixel-art tool they had built earlier to help generate the game's visual assets.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

VIDRAFT's ViKernel Embeds Safety OS Controls Directly Into AI Model Weights

VIDRAFT has published ViKernel, a project that integrates an operating-system-style layer, including boot integrity, a rule-based policy engine, an append-only audit chain, and a kill switch, directly into an AI model's weights. The company argues that external wrappers and prompt filters can be removed or bypassed, whereas controls stored in the weights travel with the model file. The approach is presented as a response to the concern that the most capable component in an agentic system often has the weakest internal controls. A desktop-style interactive demo, ViKernel-Desktop v0.1, is publicly available on Hugging Face Spaces to visualize kernel state and kill/resume controls. The source is a conceptual and architectural write-up and does not include quantitative benchmark results.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Leantime API keys act as service accounts with broad visible access risks

Leantime, a project planning and task management tool with an API, uses users, roles, projects, and API keys that can function as durable service accounts. Internet-facing deployments may therefore expose credentials able to read or modify project data, and a ZoomEye count-only query returned 960 assets matching the Leantime fingerprint, though this does not confirm that all are active instances. The guidance recommends inventorying every API key by owner, role, project scope, and last use, and removing unused experimental keys. Administrators are advised to restrict who can create keys, alert on key and role changes, and verify API-level permissions with low-privilege test accounts. Self-hosted operators should also review secret storage, file permissions, and leftover setup paths.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Prefab UI Python Sandbox Flaw Allowed Host File Access; Upgrade to 0.21

A critical vulnerability, CVE-2026-120338, was disclosed in Prefab UI's Generative UI sandbox, affecting versions 0.14.0 through 0.20.2 and rated CVSS 10.0. The sandbox, which runs caller-supplied Python inside Pyodide within a Deno subprocess, was undermined by unrestricted Deno permissions and exposure of the Deno API to Python code. This allowed attackers to read and write files on the host system. Researchers at JFrog Security Research demonstrated that writing a .pth file into a server's virtualenv could execute code outside the sandbox on subsequent interpreter starts. The fixed versions, 0.21.0 and 0.21.1, were released in late October, before the advisory was published, and users of FastMCP with Generative UI enabled are advised to upgrade.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most of my server's 'bot' traffic was its own health checks, not robots

The author added a counter to their own site's analytics to see who was visiting and found an inflated figure of 21,791 visits. Grouping the data showed that 20,709 of those came from curl requests to the homepage, sent from three addresses, which turned out to be each app container's health check hitting its own server. Link previews from Facebook also contaminated the numbers, and the real AI crawlers had only sent one request each. The author fixed the counting logic, removed the heartbeat traffic, and found that the actual figure for the first day was 914 visits from 26 addresses. They also noted that well-behaved crawlers like Googlebot, Microsoft and OpenAI self-identify through the From: header, which helped answer who runs the bots.

0 comments Read more at DEV Community