---
title: "Code Review Gauntlet"
url: "https://aigamehub.app/ja/games/code-review-gauntlet-b7d52b"
source: "https://github.com/pisan-labs/code-review-gauntlet"
source_type: "github"
play_url: "https://code-review-gauntlet.pisan.me"
platform: "desktop"
login_required: false
pricing: "free"
origin: "original"
ai_tools: ["Claude Code"]
game_languages: ["en"]
author: "pisan-labs"
author_handle: "pisan-labs"
category: "カジュアル"
categories: ["casual", "puzzle"]
tags: ["bug-hunting", "code-review", "daily-challenge", "educational", "javascript", "programming"]
added: "2026-11-05T06:09:04.983Z"
updated: "2026-11-05T06:09:04.983Z"
locale: "ja"
content_locale: "ja"
---

# Code Review Gauntlet

JavaScript、Python、SQL のスニペット内に仕込まれたバグ、セキュリティホール、コードスメルを含む行をクリックする時間制限付きパズルゲーム。

## Description

各ラウンドでは、構文的に有効な短いコードスニペットが表示され、1〜3 個の仕込まれた欠陥と、難易度に応じたカウントダウン（初級、中級、上級で 90/120/150 秒）があります。レビューで指摘するすべての行をクリックして送信するか、タイマーが切れるまでです。その後、すべての欠陥がカテゴリ、根本原因、修正方法とともに明らかになります。見つけた行は緑、見逃した行は赤、誤って指摘した行は琥珀色になります。採点では、見つけた欠陥 1 件につき 100 点を付与し、問題のない行を指摘するごとに 25 点を減点し、パーフェクトなラウンドに限りタイムボーナスを加算します。評価は D から S までです。パズルは、手書きのテンプレートと単一行の変異に対するシード付きジェネレーターから生成されるため、ラウンドは再現可能でオフラインでも動作します。デイリーチャレンジでは、ローカル日付をシードにハッシュ化するため、すべてのプレイヤーが同じパズルを取得でき、毎日最初の試行のみが採点されます。ローカルのレビュアープロフィールは、ラウンド数、最高スコアと平均スコア、デイリー連続記録、およびロジック、null 安全性、セキュリティ、パフォーマンス、スタイルにわたる正確さを追跡します。

## Original post

A timed code review game: click the lines with planted bugs, security holes and code smells in JavaScript, Python and SQL snippets, then see every defect explained with its fix. Seeded puzzles, a shared daily challenge and a skill radar, all offline. Built with Claude Code.

Topics: bug-hunting, claude-code, code-review, game, javascript, programming-education, python, secure-coding, sql, typescript

# Code Review Gauntlet Race to spot planted bugs, security holes, and code smells in realistic code snippets before the timer runs out — then get an annotated explainer of everything you missed. ![A Novice round plants two defects in a JavaScript comment renderer; flagging the innerHTML line and submitting scores 100 points, marks the found XSS line green and the missed div line red, and explains each defect with its fix](demo.gif) - **Live site:** https://code-review-gauntlet.pisan.me - **Source:** https://github.com/pisanuw/Claude-capstone/tree/main/code-review-gauntlet - **Host:** Netlify (fully static; no backend, no API keys). - **Idea:** [`pisanuw/daily-project-ideas`](https://github.com/pisanuw/daily-project-ideas), 2026-08-11 idea 1. ## How a round works 1. Pick a tier (novice / intermediate / expert) or play the shared **daily challenge**. 2. A snippet appears with 1–3 planted defects and a tier-scaled countdown (90/120/150 seconds). Click every line you would flag in review. 3. Submit (or run out of time). Every defect is revealed with its category, root cause, and fix; found lines are green, missed lines red, false flags amber. 4. Scoring: 100 points per defect found, −25 per clean line flagged, and a time bonus **only when you found everything** — so spraying flags or racing past bugs both lose. Grades run D to S. Your **reviewer profile** (localStorage) tracks rounds, best/average score, daily streak, and a radar chart of accuracy across the five defect categories: logic, null-safety, security, performance, style. ## The deterministic puzzle engine The original idea called for Claude API puzzle generation and a Supabase leaderboard. Both are replaced with deterministic client-side logic: - A library of **11 hand-written clean templates** (JavaScript, Python, SQL) carries a catalogue of **51 single-line mutations**, each tagged with a category, tier, title, root-cause explanation, and fix. Defects range from off-by-one loops and inverted guards to SQL injection, XSS sinks, timing-unsafe comparisons, TOCTOU races, and non-sargable joins. - A seeded PRNG (mulberry32 over an xmur3 hash) picks a template, guarantees at least one defect of the requested tier, fills to the round's defect count from allowed tiers, and never plants two defects on one line. Because every mutation rewrites exactly one verbatim line, generated code always stays syntactically valid. - The **daily challenge** hashes the local date into the seed, so every player gets the same puzzle with no server, and only the first attempt of the day is scored. Same seed → same puzzle: rounds are reproducible, offline, and free. ## Development ```bash npm install npm run dev # local dev server npm run lint # eslint npm run typecheck # tsc --noEmit npm run coverage # vitest with >=85% thresholds (46 tests) npm run build # production bundle in dist/ ``` No environment variables are needed (see `.env.example`). ## Structure ``` src/core/ rng, puzzle generator, scoring, streaks, prof