A year dial
One cabinet that changes with the year you pick. Eight eras: Vector, Golden Arcade, 16-Bit, Early Web, Flash Era, One-Tap, Indie Pocket and Daily Puzzle.
Unflatline Original · Case study
Eracade: a free arcade, built like a bank vault.
Eracade is a browser arcade of 202 games, from 1977 vector phosphor to today's daily puzzles. A small team built it with the same tools and review we bring to client work. It is the clearest public example of how we treat a product people actually use.
At a glance
What shipped.
Eracade opens to the public as a beta on Friday 30 October 2026. Play and leaderboards need no account.
- 202games: mostly originals, plus a Revived shelf of credited open-source classics
- 8 erasfrom 1977 to today, on one year dial
- Fri 30 Oct 2026public beta
- No third-party trackersand nothing loaded from outside its own domain
The product
Why we made it.
Our Originals are software we bring back for ourselves. Eracade brings back the feel of the arcade and the early web game, with original games rather than ports or clones, and a small Revived shelf that brings back open-source classics with credit to their authors. It also lets us show, in public, how we build and secure a product with real users, accounts and scores.
The Parlor
A quieter room with 16 solitaire, card, tile and board games, plus a computer opponent for the two-player ones.
Daily challenge and boards
One seeded run a day, the same for everyone, with global daily, weekly and all-time leaderboards.
Security engineering
The parts you do not see.
A game site is a small version of the apps we are asked to rescue: accounts, a database, public input and users who will try to cheat. We applied our own secure coding standard from the first commit.
- 01
Scores are verified, not trusted
The browser sends the recorded inputs of a run, not just a number. The server replays them through the same deterministic game logic and accepts the score only if the replay matches, with sanity bounds per game. Editing your own local score does nothing to the boards.
- 02
Passkeys first, magic links as a fallback
Accounts are optional and exist to sync a collection between devices. Sign-in uses WebAuthn passkeys, or a short-lived single-use email link. We do not run our own password system.
- 03
Email addresses stored as keyed hashes
Email addresses are hashed with a secret key (HMAC) before they reach the database, and magic-link tokens are stored only as hashes. A copy of the database does not hand over a list of addresses.
- 04
A strict Content Security Policy
Every page restricts scripts, styles, images, fonts and connections to its own origin. There are no third-party scripts, analytics, fonts or embeds, so there is nothing external to compromise or to leak a player's visit to.
- 05
Rate limits on the expensive and the abusable
Sign-in, score submission and account routes are rate limited, and run tokens are signed so a submission can only be made for a run the server started.
- 06
Data minimisation in D1
The database holds what the product needs: initials, scores, optional account records and deletion state. Retention periods are defined and published, and a player can ask for a score or an account to be deleted.
- 07
A children's-code DPIA
Eracade is for a general audience aged 13 and over, and young people do use arcades. We wrote a data protection impact assessment against the UK Children's Code, and the site follows it: high privacy by default, no profiling, no tracking and no nudges toward weaker privacy.
- 08
Reviewed before launch
The backend, the account flows and the replay checks went through repeated security review passes with fixes re-verified, alongside automated tests for each game's logic. The site publishes a responsible disclosure policy.
What this means for your app
Same standard, your product.
If you have an app with logins, a leaderboard-style feature, user-generated input or a database someone should worry about, this is the level of care we bring. We built these pieces in a form we can reuse for client work.
- Passkey and magic-link sign-in that avoids storing passwords or raw email addresses.
- Server-side checking of anything a client reports, such as scores, results or quantities.
- A strict CSP and a no-third-party-scripts posture, verified with automated checks.
- A written privacy review sized to the audience, including young users.
Eracade is operated by Atarus Offensive Security LLC and made by Unflatline. It is a separate consumer product with its own privacy policy. Nothing a player does on Eracade is shared with Unflatline's studio or sales work.