Birds

Case study · Product

Real-time multiplayer platform

A browser platform where several people act on shared state at the same time, every outcome is decided by the server, and any result can be verified after the fact.

ServerAuthoritative state
ProvableVerifiable outcomes
LiveMultiplayer tables
EdgeWorkers and D1

Why this is the hard category

A brochure site can be wrong for an hour and nobody is harmed. A system where multiple people act on the same state at the same instant cannot be wrong for a millisecond, because someone will notice and someone will be able to exploit it.

This project was built to take that seriously from the first line rather than to patch it later.

Server-authoritative by construction

Nothing meaningful is decided in the browser. The client is a rendering surface and an input device. Every outcome, balance change and state transition is computed and validated on the server, which means there is no client-side value worth tampering with. Editing anything in the browser changes what one person sees and nothing about what is true.

Verifiable fairness

Where outcomes matter, the system commits to them in advance in a way that can be checked afterward. A participant can confirm that a result was determined before they acted and not adjusted after. That converts trust from a claim into something checkable.

The same mechanism surfaced a real bug during development, in the path that reset the commitment sequence. It was caught and fixed because the design made it observable rather than because someone got lucky.

Concurrency

Two people acting on the same record at the same moment is a design problem, not an edge case. The system guards the paths where that matters so a simultaneous action cannot produce a double effect. This was tested adversarially, not assumed.

Live multiplayer

Beyond single-player interactions, the platform runs full multiplayer tables: shared state across participants, per-participant views that reveal only what that person should see, live chat, and sane behaviour when someone's connection drops mid-action.

Security review

The platform was put through a hands-on adversarial review rather than a checklist. The areas that actually matter, money movement, administrative access and injection, held. The findings that came out of it were operational hardening items, and having a written record of what was tested is worth as much as the result.

Techniques

  • Authority. All state transitions server side
  • Commitment. Outcomes verifiable after the fact
  • Concurrency guards. On every balance path
  • Per-view state. Clients receive only their own view
  • Adversarial testing. Reviewed as an attacker would
Cloudflare WorkersD1Real-time Server-authoritativeCryptographic commitmentSecurity review

This one is not linked publicly. If you are evaluating us on engineering and want to see it running, ask and we will walk you through it live.

Contact

Building something that has to be correct?

Describe it and we will tell you what it would take, at no charge.

hello@example.com