Snake on the 404

A small canvas Snake that appears when you land on a page that does not exist, with a public leaderboard. It mounts through a client-only dynamic import, because the first piece of food is placed with a random number and a server render would disagree with the hydration. There is no button to reveal it: reaching a broken URL is already the secret door, and a click between the visitor and the only entertaining thing on the page was one click too many.

The problem

A 404 is where a visit ends. It is also the one page guaranteed to be reached by accident, which makes it the cheapest place in the site to be worth remembering.

The solution

A playable board and an anonymous scoreboard. Submitting a score is the only anonymous write in the project that a third party can modify afterwards, so the row returned at creation comes with a single-use token, without which the later update is refused, and the public endpoints live in their own controller so that no anonymous action ever shares a class with the permission-gated admin report.

What it taught

Mixing anonymous and gated actions in one controller means the attribute has to be applied action by action, and the action somebody adds next month is born unprotected. Splitting the controller costs one file and removes the whole class of mistake.