Overview#

At a IT Messe in Wien, I participated in a deliberately open-ended technical challenge: reach the maximum high score in a custom-built browser game.

The organizers defined no restrictions on how the score could be achieved, which turned it from a gameplay task into a system design exercise.

Instead of optimizing reflexes, I analyzed architecture, trust boundaries, and data flow between client and backend.

The result was maximum score and a Nintendo Switch, and more importantly a practical reminder that understanding systems beats surface interaction.

Technical Highlights#

  • Analyzed the client-server interaction model
  • Identified where validation occurred and where it did not
  • Observed trust assumptions between frontend and backend
  • Evaluated how score state was processed and accepted
  • Reached maximum score without bypassing authentication or exploiting vulnerabilities
  • Relied on system behavior analysis, not external manipulation

Key Lessons#

  • Frontend is UX, not authority
  • Client-side constraints are presentation logic, not security boundaries
  • Undefined constraints create architectural opportunities
  • Most real-world issues come from misplaced trust, not complex exploits
  • Thinking in systems is more effective than interacting at interface level

This experience reinforced a core engineering question: Where is validation actually enforced?

Technologies#

  • Browser DevTools
  • HTTP request and response inspection
  • Client-server architecture analysis
  • Frontend rendering and backend validation flow analysis
  • Standard browser inspection capabilities only
Flowchart
flowchart TD
    A[Challenge announced] --> B[Define objective: maximum score]
    B --> C[Analyze client behavior]
    C --> D[Trace score submission flow]
    D --> E[Identify trust boundary]
    E --> F[Test system behavior within given rules]
    F --> G[Maximum score achieved]

Details
The challenge rewarded creative technical thinking. No method restrictions were defined, only the target outcome. By shifting from player perspective to system observer perspective, I focused on: - How the score was generated - How it was transmitted - Where it was accepted - Whether backend validation was independently enforced The backend behaved consistently with its trust assumptions, which made the same maximum score reproducible. This was not about breaking a system. It was about understanding it.

Gallery

3 images