Home › Dev Log
Dev Log — What's New at Forge
Hey, Dev here. This is my running diary of everything I'm building, breaking, and fixing on Forge. No marketing fluff — just real updates about what's changing and why. If you want to follow along with the development of a student-built AI game, this is the place.
JUNE 2026
SECURITY
Security Hardening — Because Multiplayer Trust Matters
This month I went full security mode. Running a real-time multiplayer game means opening WebSocket connections to the world, and that's a playground for bad actors if you're not careful. I added several layers: strict input validation on every user-generated field (player names, topic selections, answer choices), a WebSocket action allowlist so only pre-approved message types can pass through, and per-IP rate limiting on all API endpoints to prevent spam attacks.
The biggest win was prompt injection protection on the topic input. Since players can type any topic into the AI, someone could theoretically try to trick Gemini into generating harmful content. I sanitized and constrained the prompt structure using a regex blocklist and a validated template, so the AI only ever sees a safe, predictable input — no matter what players type, they can't break out of the quiz context.
I also fixed an XFF (X-Forwarded-For) header spoofing vulnerability in the rate limiter — on Google Cloud Run, the real client IP is always the last entry in that header, not the first. Trusting the first entry would let anyone bypass rate limits by faking it. Why does all this matter? Because a cheater ruins the fun for everyone. Forge should be a fair, safe space where your knowledge is the only weapon — and now it is.
— Dev
MAY 2026
BACKEND + LEADERBOARD
Supabase Leaderboard, Coins, Trophies, and a Donation System
May was all about giving you something to fight for. I launched a persistent leaderboard powered by Supabase — a PostgreSQL database I can run entirely on the free tier (because, honestly, I'm a student and cloud bills are real). The leaderboard has two tabs: Coins and Trophies. Coins are earned for correct answers, speed bonuses, and streaks. Trophies are for bigger milestones — like winning a multiplayer match. Now your rank persists even after you close the browser and come back days later.
I chose Supabase because it's free, has solid documentation, and supports real-time subscriptions out of the box. The alternative was building my own PostgreSQL setup on Cloud Run, which would have cost money and taken weeks. Supabase let me ship in days. The leaderboard upserts at the end of every game using a Google account ID as the primary key — so no matter what name you're playing with, your stats follow you.
I also added a micro-donation system through Chai4Me. It's a simple "buy the dev a chai" button — no pay-to-win, no premium features locked behind it. Just a way for people who enjoy the game to keep the cloud bills covered. I appreciate every single one. The donation system uses a manual approval workflow: you submit a UPI transaction ID, I verify it, and then your name appears on the donor leaderboard. No automation — just honesty.
— Dev
APRIL 2026
FEATURE
Team Mode — The Feature You Asked For
You spoke, I listened. Team Mode was the most requested feature after launch, and honestly — it was a beast to build. Coordinating multiple players across two teams in real time, aggregating scores correctly, synchronizing game state for everyone simultaneously, and making sure no team could gain an unfair timing advantage: my brain hurt for weeks. But we got there.
Here's how it works: you create a room, lock it once everyone has joined, split into teams, and each team nominates a quiz topic. Before the game starts, a randomizer wheel spins and picks which team's topic everyone will play on — adding a fun, chaotic energy because nobody knows what's coming until the wheel stops. Team scores are aggregated live from each member's individual performance, so a strong player on your team genuinely pulls the group forward.
The hardest technical challenge was synchronizing the question broadcast. In a solo or classic game, everyone receives the question at roughly the same time anyway. But with teams, I needed a guarantee that no team's players were getting the question even a fraction of a second before the other team's. I solved it by firing a single server-side broadcast task that sends to all players in parallel using asyncio.gather(), rather than looping through them sequentially. It's not perfect to the millisecond, but it's as fair as the internet allows.
— Dev
MARCH 2026
LAUNCH
The Very First Version — Solo, Classic, and the AI Pipeline
This is where it all began. Back in March, I had a simple idea: what if trivia questions were never repeated? What if the AI generated them fresh each time, so every game felt genuinely new? That seed grew into Forge during my semester break. The first working version had just Solo Mode (you vs the AI) and Classic Multiplayer (free-for-all, no teams, no leaderboard).
I hacked together the AI question pipeline using Google Gemini's API, FastAPI for the backend, and vanilla JavaScript on the frontend. Every time you picked a topic, the backend would fire off a carefully crafted prompt to Gemini, get back a structured JSON array of ten questions, validate each one with Pydantic (checking for exactly four options, a valid correct index, no malformed data), and serve it to your screen in real time over WebSockets.
I started this during my semester break primarily because I wanted to learn how to build a real-time AI-powered application — not just a chatbot, but something interactive and multiplayer. I also wanted to prove that a solo student developer could build something genuinely fun without a team, without a budget, and without paid infrastructure. Looking back, that first version was rough in places — WebSocket reconnections were flaky, there was no authentication, and the frontend was held together with string — but it worked. It made people smile. That was enough to keep me going.
— Dev