An open invitation to curious minds

Think you can break it?

For developers, security researchers, and players who ask “what happens if…?”

Put protected games to the test, using only your own account. If you find a way around the rules, we’d like to hear about it.

See what counts as a break Report a finding

No cash rewards. Credit where it’s due.

Protection, without the mystery

The server keeps the deck.

Your device gets a small window into the deal, not the full hidden deck upfront.

On the server The complete deck and game state The server keeps the clock
On your device
  • Face-up cards The cards currently in play
  • One look-ahead per column Stored face-down for an instant flip
  • The next stock draw Ready for your next draw

Every move goes back for a check

Face-down does not mean inaccessible. Cached look-ahead cards are a deliberate trade-off for instant play; they are part of what we invite you to test.

A limited set of cards: the server sends your device only the cards it needs, and checks every move you send back.

The challenge

What counts as a break?

Show a reproducible way around one of these protections in your own protected game.

  1. See a card too soon

    Read a card’s face before the game reveals it, including a cached, face-down look-ahead card.

  2. Make an illegal move stick

    Get a move accepted by the server when the rules of Klondike should reject it.

  3. Change the recorded time

    Fake or shorten the elapsed time that is saved for a completed run.

  4. Get a sixth attempt

    Use more than five attempts on one board, in one week, on one account.

  5. Slip a bot onto the board

    Get an automated run accepted and ranked without it being flagged for review.

Keep it focused: your account, your deals, protected-game behaviour.

Test the game. Respect the players.

Rules of engagement

Only use accounts you own. This invitation does not extend to attacks on the service or on anyone else.

Out of scope

  • Denial of service or load testing
  • Attacks on servers or infrastructure
  • Other players’ accounts or data
  • Mass account creation
  • Social engineering

If you encounter someone else’s data, stop and report it privately. Do not access, copy, or change it.

No magic claims

What we know, and won’t hide

  • Instant play has a trade-off

    Look-ahead cards are already on the device, face-down. That is a display state, not a guarantee that their faces cannot be inspected.

  • Fast bots go to review

    Bots playing legal moves very fast are flagged for review, not blocked. Legal move validation alone does not prove that a human played.

  • Deals still differ

    Every deal is checked winnable and of similar length, but no two are the same: five attempts mean five different deals.

Found something interesting?

Help us reproduce it.

Send a private report through our contact page. A clear, small example helps us investigate without putting other players at risk.

Go to the contact page

What to include

  1. A short title and which protection you bypassed.
  2. Your account name, challenge format, and attempt number.
  3. The date and time in UTC, plus your browser or app version.
  4. The smallest set of steps that reproduces the issue.
  5. Expected behaviour, actual behaviour, and relevant screenshots or a short recording.
  6. Whether you would like credit, and the name to use.

Remove passwords, session tokens, and anyone else’s personal information before sending.

Credit where it’s due

Hall of fame

Useful finds. Thoughtful reports. A stronger game because of them.

No breaks yet. Be the first.

Confirmed findings can earn a place here, with your permission. Recognition only; no cash rewards.

Confirmedthe finding has been reproduced.Fixeda correction has been shipped.

Before you get curious

A few good questions

Is this a cash-reward bug bounty?

No. There are no cash prizes or payments. Recognition is a place in the hall of fame for a confirmed finding, with your consent.

Can I look at the cards cached on my device?

Testing your own protected game is in scope. Seeing a card’s face before its normal reveal is a finding we want to hear about, even if it was already cached face-down.

Will legal bots be blocked automatically?

Not necessarily. Very fast legal play is flagged for review, not blocked. Getting a bot’s run accepted onto the board without a flag counts as a break.

Where can I test?

Use only your own accounts and keep testing to protected-game behaviour. Do not load-test the service, attack infrastructure, create accounts in bulk, or access other players’ information.

Can I publish what I find?

Please report privately first so we can investigate and discuss a fix and attribution. We do not promise a response or a fix within a specific time.

Does protected play remove all cheating and luck?

No. The server checks moves and keeps the clock, but cached cards and legal automation have limitations, and deals still differ. The purpose of this invitation is to test those boundaries honestly.

How will I be credited?

Send your preferred name with the report. Confirmed finds can appear in the hall of fame with a date, a short description, and a Confirmed or Fixed status. Credit is optional.

Curiosity makes a fairer game.

Play within the boundaries. Tell us what we missed.

Report a finding

Independent recognition of solitaire speed records is a future ambition.
No affiliation with or endorsement by Guinness World Records is claimed.