security
No email required
Cross-device player accounts arrive via Google sign-in, chosen over a magic link or a sync code, plus the claim-or-discard flow, GDPR deletion, and the review findings that shaped the implementation.
The first thing it caught
Client-side error monitoring finally gives the solo maintainer visibility into what breaks in players' browsers, and catches a real bug within hours of shipping.
Healthy before active
Turning shared MCP servers into reviewed, age-gated installations that only become active after a real protocol handshake.
Minimum release age gate for developer CLI auto-updates
A supply-chain mitigation that delays devcontainer CLI updates until they are at least three days old.
The allowlist was too generous
Two routine blog handoffs expose a less routine problem: broad agent permissions were approving destructive commands without review.
More than one agent in the workshop
Codex and Antigravity join Claude Code inside the devcontainer, with pinned versions, shared skills, and checks that the safety boundaries are real.
storing less, submitting once
Privacy deletion of rejected words and making the leaderboard submission idempotent to ensure a service players can trust.
A room where the agent can work
The project moves into a devcontainer with local data, restricted networking, scoped Git identity, and enough browser tooling to run the whole development loop safely.