Hollowed Stone is a personal project, and it is here because it shows the other half of what we do: software, not just marketing pages. It started as Python versions of old abstract strategy games, Tablut, Fanorona, Surakarta, that ran on one computer at home next to boards cut on a CNC router. The goal was to let two people play them from anywhere, free, with no account, no password, no tracking and no ads.
It went live on Cloudflare in March 2026 and grew to ten games. In July a friend who does penetration testing opened it and his browser warned him about cross-site scripting before he had even played a move. That review, and what we did about it, is most of this case study.
At a glance#
| Site | hollowedstone.com |
| What it is | Free online two-player strategy board games |
| Games | 10 playable, each with a lobby, board and replay viewer |
| Built with | Vanilla JavaScript, SVG boards, Cloudflare Workers and KV |
| Running cost | $0 a month on Cloudflare’s free tier |
| Our role | Designer, developer and owner |
Where it started#
- Local Python versions of each game, with no website at all.
- Physical boards cut on a CNC router and pieces from a 3D printer, which is where the look of the site comes from.
How it works#
- No framework and no build step. Each board is SVG drawn by plain JavaScript modules, so a page is small and loads fast.
- One rules engine, used twice. The same rules code runs in the browser for instant feedback and on the server to check every move, so nobody can cheat by editing the page.
- Cloudflare Workers and KV. A Worker serves the pages and the game API, and each game’s state is stored in Cloudflare KV for 365 days so a game can be replayed.
- Private games without accounts. An access code plus a per-player token instead of a login. The admin page sits behind Cloudflare Access.
- Deploys from GitHub. A push to the main branch is live in about a minute.
What we built and changed#
- March 2026: the platform, then Nine Men’s Morris, Fanorona, Seega, Surakarta and the rest added one at a time, each with a written rulebook and SVG diagrams. Terms, privacy and about pages, a feedback form with a simple captcha, and a public table of what the site costs to run.
- July 2026, the security review: 3 high and 2 medium findings, all fixed
in version 0.4.0:
- No security headers on any response: added to every page and every API reply.
- A reflected cross-site scripting hole in one game: fixed by writing text as text, never as HTML.
- One game sent each player the other player’s IP address: removed from the game state.
- Error messages that leaked internal detail: removed.
- An API that accepted requests from any website: locked to its own origin.
- November 2026: game retention set to 365 days and stated in the privacy policy. The default workers.dev and preview addresses are switched off on every deploy, so the only way in is the real domain.
Results#
- PageSpeed: 100 on mobile, 100 on desktop, measured 2026-11-05.
- All 3 high and 2 medium audit findings fixed. Content Security Policy, HSTS, nosniff, referrer, permissions and frame headers are all live.
- Search Console and Cloudflare traffic figures: details coming soon.
What is next#
- Tighten the Content Security Policy further by removing inline styles, the last open item from the audit.
- A meta description, sitemap and llms.txt, so search engines and AI answer engines can find the games by name.
- More games from a list of 15 candidates, including Tak, Quoridor and Breakthrough.