A games marketplace that lets strangers run their code on our servers — safely

Anyone can upload. Everything else follows from that.

Most marketplaces sell things. GameFoundry hands visitors a file that a stranger wrote and runs it — in the browser, on the same infrastructure that holds every account on the platform. A single careless assumption anywhere in that chain turns the product into a distribution channel for malware.

That reframed the whole build. Before we could think about catalogue design or the prize mechanic, we had to answer three questions honestly. How do we accept an arbitrary binary from an unverified account without trusting a single byte of it? How do we let an untrusted web build execute in the browser without it ever touching a logged-in session? And how do we run a real cash prize round — money leaving a wallet every week — with rules a stranger can audit and no manual guesswork in between?

On top of that sat the ordinary marketplace problem: a catalogue that stays useful as it grows, a rating system that cannot be gamed by the people it rewards, and a reason for anyone to come back next week. That part is ordinary web application development; the upload pipeline was not.

How the platform is built

The backend is Node.js and Express on SQLite via better-sqlite3, with fourteen tables covering accounts, sessions, games, media, reviews, scores, prizes, reports and an audit log. Authentication uses bcrypt hashing with server-side sessions: the cookie is __Host- prefixed and httpOnly, and the database stores only a SHA-256 hash of the session token. Uploads are handled by multer and archives inspected with adm-zip. ClamAV is an optional dependency, so the server still boots without it — but the upload pipeline fails closed: an unscanned or unscannable build is held for manual review, never auto-published.

The frontend is deliberately framework-free: semantic HTML, hand-written CSS and vanilla JavaScript, with a custom internationalisation layer covering ten languages and around 3,000 translated strings. Every response carries a Content-Security-Policy with no inline scripts anywhere — strict on the main site, sandboxed for uploaded game HTML — plus nosniff, frame protection, referrer policy, permissions policy and HSTS. Rate limiting is applied per route family: 300 requests a minute globally, tightening to 40 per fifteen minutes on authentication and 30 an hour on uploads.

The Telegram Mini App runs inside the same Express application but authorises writes through Telegram’s HMAC-signed initData instead of the session cookie, because a SameSite cookie is never delivered inside a cross-site Telegram frame. The bot is a webhook mounted into the same app and calls the Bot API through native fetch — no additional dependency.

The platform runs on Railway behind a TLS proxy with a persistent volume for the database and game files, and ships through a scripted git-push release.