cybermar8cybermar8A full-stack aim-training web game — 100 free levels, Endless mode, and ranked 1v1 — built on vanilla JavaScript and 57 Netlify serverless functions, with hand-rolled session auth, optional email-based 2FA, and Stripe-gated cosmetics. Live in production.
Only two runtime dependencies power the entire backend: stripe and @netlify/blobs. A separate Electron wrapper packages the same live site as a Windows desktop app with auto-update.
No auth library — scrypt password hashing with a random salt, and HMAC-SHA256-signed opaque session-id cookies (HttpOnly, Secure, SameSite=Lax) backed by a server-side, revocable session store in Netlify Blobs, all on Node's built-in crypto module.
2FA is optional and email-based: verifying an email enables it, and login then emails a 6-digit code instead of issuing a session directly — hashed, single-use, 10-minute expiry, capped at 5 attempts. Disabling 2FA requires re-entering the password.
Documented hardening: rate-limited constant-time login (a dummy hash comparison runs even for usernames that don't exist, to prevent enumeration), every function checks the requester owns the resource it's acting on, and score submissions are server-side validated against hits/shots/time/level consistency.
All 100 campaign levels, Endless Mode, and ranked 1v1 are free. Progression gates on 3-starring a level, not on payment. Stripe Checkout sells a one-time "Pro pass" ($0.99/30 days, $9.99/year, or $29.99 forever — no subscriptions) that unlocks premium crosshair styles and 3D-shaded targets. The item shop says it plainly: "Cosmetics only, never pay-to-win."
