Case study 07
The Golden Run
A free, mobile-first fan football arcade: drag, curl and strike past the keeper, with every counted goal verified on the server.
Problem
Cristiano Ronaldo's chase for 1,000 career goals gave football fans a shared story. A goal counter would be easy to build and easy to fake. A fan game only works if the goals feel earned and the competition rewards real skill.
Product direction
Turn the moment into a proper arcade football game rather than a counter: precise drag-to-shoot controls with curl and lift, keepers of rising difficulty, story matchdays from 2008, a career Road to 1,000 and a weekly Golden Cup. Free to play, with no cash prizes and nothing to buy.
My role
Concept, product design and engineering: game design, Phaser gameplay and physics, the Cloudflare Worker API, passkey accounts, server-side shot verification and the weekly competition. Published by BlindspotLab Limited.
Engineering approach
- A React and Phaser single-page app served from one Cloudflare Worker with Workers Static Assets. The Worker server-renders share previews and metadata for player and cup pages.
- Fair play by replay: the device sends only each shot's inputs, and the server replays them with the same physics and goalkeeper to decide the result. Unusual results are held for review before they reach a leaderboard.
- Passkey accounts (WebAuthn through SimpleWebAuthn): no email or password, just Face ID, fingerprint or a screen lock. Practice needs no account at all.
- D1 stores players, runs and leaderboards; Workers rate limiting protects sign-in and writes; an hourly, idempotent cron opens and closes Golden Cup weeks and records provisional winners.
Stack and constraints
- Game
- Phaser 3React 19React RouterTypeScript
- Edge
- Cloudflare WorkersStatic AssetsD1Cron TriggersRate limiting
- Identity
- Passkeys (WebAuthn)SimpleWebAuthn
- Quality
- VitestBalance and load-check scripts
- Mobile first: one-finger controls that still allow curl and lift.
- Scores must be trustworthy without trusting the client.
- An unofficial fan game: no club crests, player likeness or affiliation claims.
Design decisions
Server-authoritative shots
Replaying inputs on the server costs compute but makes the leaderboards credible, which is the whole point of a competition.
Passkeys over passwords
Dropping email and passwords lowers sign-up friction for a casual game and removes a whole class of account risk.
Skill over grind
Each verified goal counts once, and the weekly cup gives everyone the same twelve shots, so the best shooter wins rather than the most persistent.
System
Outcome and status
- Live at goldenrun.fun (checked 3 November 2026).
- Built in a day: 38 commits on 29 October 2026, in a public repository. The code is Apache-2.0; the name and branding are reserved.
- An unofficial, independent fan game, not affiliated with, endorsed by or connected to any player, club, league, competition or award.
- No player, goal or traffic figures are published here.