Don't let your AI app bankrupt you
A funny security survival game for vibe coders who ship fast and would prefer not to ship their database too.
already sharp? try the expert sus-or-ship arcade →Your first incident. No actual damage.
Ship the fix
Not the disaster
An API key is out in the wild. Bots don't take coffee breaks. Can you spot the right fix before the bill arrives?
ONE SCENARIO · NO SIGN-UP · NO REAL DAMAGE
Explore the learning roomsBYTE’S BRIEFING / LIVE DEMO
One leaked key. Your first case
Incoming disaster. Stay calm.
INCIDENT CONSOLE / TRAINING SIMULATION
The 2 AM push
You push your project to a public GitHub repo at 2 AM and go to bed proud. At 2:07 AM you bolt upright: the .env file went with it. Stripe secret key. Database password. Everything.
$ git log --oneline
a3f9c21 added env stuff (oops)
9b1d044 initial commitHeart pounding. First move?
tap to answer// how it works
// what's inside
£4.1M of disasters — all survivable
Every scenario is a real mistake AI-assisted coders ship, priced at what it costs in production. Answer wrong here, where it's free.
Security wing
Where browser-only security goes to learn humility.
Key locker
Secrets belong in env vars, not in a public confetti cannon.
Database vault
The tables are innocent. The queries are usually not.
API corridor
Your endpoints answer to anyone who asks. Anyone.
AI agent lab
Helpful agents, tiny permissions, fewer financial jump scares.
Hosting bay
The cloud is just someone else's bill collector.
Compliance office
Paperwork with teeth, but we make it less haunted.
The Perimeter
The edge of your app, where the whole internet knocks.
The Logic Floor
Every check passed. The math still robbed you.
The Incident Room
Monthly lessons from fresh disasters, with the names filed off.
+ a new Incident Room drop every month, from fresh real-world disasters
// not just a quiz
A pre-launch checklist for your own app
35 concrete checks to run before you ship — RLS, secrets, CORS, billing caps, GDPR — each linked to the lesson behind it. Tick them off, track your readiness, keep it for the next project. The part you actually keep using.
Open the checklist- ✓RLS on every table, service key server-side
- ✓Secrets out of the client and git history
- ✓Billing caps before you share the link
- ✓A real deletion path for GDPR
// pricing
Cheaper than one leaked key
Free
£0
Two full doors, the quiz, the arcade, and a checklist preview — enough to learn the lesson.
See planPopularEarly bird
£19£9
All base rooms — 94 scenarios — plus the checklist, certificate, and avatar builder, during launch.
See planSubscriber
£5/mo
Everything in full, plus The Incident Room and exclusive cosmetics.
See plan