---
title: "Code Review Gauntlet"
url: "https://aigamehub.app/zh-tw/games/code-review-gauntlet-b7d52b"
source: "https://github.com/pisan-labs/code-review-gauntlet"
source_type: "github"
play_url: "https://code-review-gauntlet.pisan.me"
platform: "desktop"
login_required: false
pricing: "free"
origin: "original"
ai_tools: ["Claude Code"]
game_languages: ["en"]
author: "pisan-labs"
author_handle: "pisan-labs"
category: "休閒"
categories: ["casual", "puzzle"]
tags: ["bug-hunting", "code-review", "daily-challenge", "educational", "javascript", "programming"]
added: "2026-11-05T06:09:04.983Z"
updated: "2026-11-05T06:09:04.983Z"
locale: "zh-tw"
content_locale: "zh-tw"
---

# Code Review Gauntlet

一款限時解謎遊戲，玩家要在 JavaScript、Python 與 SQL 程式碼片段中，點選含有刻意埋入的錯誤、安全漏洞與程式碼異味的行。

## Description

每回合會顯示一段簡短且語法有效的程式碼片段，其中含有一到三個刻意埋入的缺陷，並搭配依難度分級的倒數計時（新手、中階與專家分別為 90/120/150 秒）。你要點選每一個在審查中會標記的行並提交，否則倒數計時就會結束。接著會揭露所有缺陷及其類別、根本原因與修正方式：找到的行會變成綠色，漏掉的行會變成紅色，誤標的行會變成琥珀色。計分方式是每找到一個缺陷給 100 分，每標記一個乾淨的行扣 25 分，且只有在完美回合才會加上時間獎勵，評級從 D 到 S。謎題來自以種子驅動的生成器，根據手寫範本與單行變異產生，因此回合可重現且可離線運作；每日挑戰會將本機日期雜湊進種子，讓每位玩家拿到相同的謎題，而且每天只有第一次嘗試會計分。本機審查者個人檔案會追蹤回合數、最佳與平均分數、每日連續紀錄，以及邏輯、null 安全、安全性、效能與風格方面的準確率。

## Original post

A timed code review game: click the lines with planted bugs, security holes and code smells in JavaScript, Python and SQL snippets, then see every defect explained with its fix. Seeded puzzles, a shared daily challenge and a skill radar, all offline. Built with Claude Code.

Topics: bug-hunting, claude-code, code-review, game, javascript, programming-education, python, secure-coding, sql, typescript

# Code Review Gauntlet Race to spot planted bugs, security holes, and code smells in realistic code snippets before the timer runs out — then get an annotated explainer of everything you missed. ![A Novice round plants two defects in a JavaScript comment renderer; flagging the innerHTML line and submitting scores 100 points, marks the found XSS line green and the missed div line red, and explains each defect with its fix](demo.gif) - **Live site:** https://code-review-gauntlet.pisan.me - **Source:** https://github.com/pisanuw/Claude-capstone/tree/main/code-review-gauntlet - **Host:** Netlify (fully static; no backend, no API keys). - **Idea:** [`pisanuw/daily-project-ideas`](https://github.com/pisanuw/daily-project-ideas), 2026-08-11 idea 1. ## How a round works 1. Pick a tier (novice / intermediate / expert) or play the shared **daily challenge**. 2. A snippet appears with 1–3 planted defects and a tier-scaled countdown (90/120/150 seconds). Click every line you would flag in review. 3. Submit (or run out of time). Every defect is revealed with its category, root cause, and fix; found lines are green, missed lines red, false flags amber. 4. Scoring: 100 points per defect found, −25 per clean line flagged, and a time bonus **only when you found everything** — so spraying flags or racing past bugs both lose. Grades run D to S. Your **reviewer profile** (localStorage) tracks rounds, best/average score, daily streak, and a radar chart of accuracy across the five defect categories: logic, null-safety, security, performance, style. ## The deterministic puzzle engine The original idea called for Claude API puzzle generation and a Supabase leaderboard. Both are replaced with deterministic client-side logic: - A library of **11 hand-written clean templates** (JavaScript, Python, SQL) carries a catalogue of **51 single-line mutations**, each tagged with a category, tier, title, root-cause explanation, and fix. Defects range from off-by-one loops and inverted guards to SQL injection, XSS sinks, timing-unsafe comparisons, TOCTOU races, and non-sargable joins. - A seeded PRNG (mulberry32 over an xmur3 hash) picks a template, guarantees at least one defect of the requested tier, fills to the round's defect count from allowed tiers, and never plants two defects on one line. Because every mutation rewrites exactly one verbatim line, generated code always stays syntactically valid. - The **daily challenge** hashes the local date into the seed, so every player gets the same puzzle with no server, and only the first attempt of the day is scored. Same seed → same puzzle: rounds are reproducible, offline, and free. ## Development ```bash npm install npm run dev # local dev server npm run lint # eslint npm run typecheck # tsc --noEmit npm run coverage # vitest with >=85% thresholds (46 tests) npm run build # production bundle in dist/ ``` No environment variables are needed (see `.env.example`). ## Structure ``` src/core/ rng, puzzle generator, scoring, streaks, prof