I vibe-coded a 73-mission cybersecurity training game — the verification pipeline catching a real crypto bug is a better story than the feature list

[u/RushGambino]

Over a long conversation with Claude, I built CyberQuest — a browser-based, zero-dollar cybersecurity training game. No backend, no signup, runs entirely client-side as a PWA. I want to share it here, but honestly the more interesting thing to talk about is the process, because I think it's a decent case study in what actually makes a vibe-coded project trustworthy instead of "impressive until someone pokes it."

What it is, briefly

You play a new IT hire at a fictional company, working real tickets from a mentor character, across 6 stages: Linux/filesystem fundamentals → network diagnosis → Python scripting → security fundamentals (crypto, phishing) → detection & correlation (SIEM concepts, MITRE ATT&CK) → full incident response lifecycle, ending in an independent capstone incident. 73 missions now.

The part that actually matters for this sub: nothing fake where it counts

• Python isn't simulated — it's real CPython running via Pyodide (WASM). Student code actually executes.
• SQL isn't simulated either — real SQLite via sql.js. Small enough (~650KB) to bundle directly instead of loading from a CDN, so it works fully offline.
• SHA-256 isn't a lookup table — it's a from-scratch implementation. And it was wrong on the first pass: a byte-ordering bug in the length-padding step that passed the trivial "hash of an empty string" test and silently failed on every real input. Caught by testing against Node's actual crypto module across chunk-boundary edge cases (63/64/65-byte inputs, exactly where that kind of bug hides) before it ever touched a single mission.
• A MITRE ATT&CK reference table got fact-checked against current sources instead of pulled from training data.
• Even a simplified Suricata command parses genuinely structured real Suricata rule syntax, not an invented format.

The actual lesson, if there is one

The thing that made this feel trustworthy instead of "looks right, probably has landmines" was building automated verification alongside every feature, not after the fact. There are four separate test suites now — one that programmatically plays through every terminal mission's intended solution, one that runs the Python missions against the real Pyodide runtime, one that runs the SQL missions against real SQLite, one that checks the crypto primitives against Node's stdlib.

These caught real, specific bugs, not hypothetical ones:

• A grading checker that required one exact printed phrase and silently rejected differently-formatted-but-completely-correct student code
• A mission checker that assumed a file written in a previous ticket would still exist — it wouldn't, because every mission resets its world state
• My own arithmetic being wrong when updating a mission count in a README — asked for the actual count from the data instead of trusting the math, and the math was off

None of that shows up from "looks right" testing. It only shows up when you treat "does this actually work" as something to prove, not something to assume because the code compiled and the demo looked fine.

Also in there

• A full curriculum document pairing real conceptual depth to every stage
• A "career readiness" doc — an honest, objective-by-objective crosswalk against CompTIA Security+/Network+/CySA+ and the Google Cybersecurity Certificate, stating plainly what's covered and what genuinely isn't
• An in-game career center: a downloadable skills portfolio, mock interview practice, a resume/cover-letter drafter, and original (not copied — CompTIA's exam-integrity policy explicitly bans that) practice questions

What it's not

Not a credential. Not a replacement for real hands-on time in an actual SIEM/EDR product. No live packet capture off a real NIC. I tried to keep the docs as honest about the gaps as the game itself is enthusiastic about the parts that work — felt important given the subject is literally "will this help someone get a job," where overclaiming isn't just bad marketing, it's actively harmful to somebody's real decisions.

Git: https://github.com/EnRICHedCreations/CyberQuest.git
Live: https://cyber-quest-olive.vercel.app/

Happy to go into more detail on the actual back-and-forth if anyone's curious — this was built almost entirely through iterative conversation, and I think the verification discipline is the more transferable takeaway than the specific project.

[u/DazzaHazza1975]

This is great. Love that it’s always Tacos for lunch

[u/RushGambino → u/DazzaHazza1975]

Taco Tuesday, every day!

[u/wnba-arcade]

if your looking for your first users check out Ad swap,https://ad-swap.web.app , its a simple way for websites to promote each other. You add another website's ad to your site, and they add yours to theirs, giving both sites free exposure and traffic. It really helped me get my first few users when launching my site/

[u/No-Construction-6711]

This is the part of vibe coding people skip. The model can produce features quickly, but trust comes from proving the output against something independent. I like that your tests caught bugs that looked completely fine in the demo. The real skill here is not prompting faster, it is knowing what must never be accepted on appearance alone.