Built by 
Why Arcade Portal
What makes it better
than the alternatives
- 01
Safe ZIP upload
BuildInstaller unpacks games with path validation, file-type allow-list and atomic replace
- 02
Accurate play and like counters
Unique keys per game/visitor/day for plays, per game/visitor for likes, so one visitor counts once
- 03
Visitor privacy
Only a salted hash is stored (Visitor::key), never an IP address
- 04
Moderated community
Comments wait for approval (switchable), honeypot and per-IP throttles on forms, members can be blocked
- 05
Ad slots with scheduling
Four positions (top, game sidebar, under game, footer) hold banners or pasted ad-network code with start/end dates
Games
- Upload HTML5 build as ZIP or embed by URL
- Title
- summary
- Markdown description
- controls note
- developer
- category
- tags
- thumbnail
- player size
- Draft
- published and scheduled status with featured flag
- Search-engine title and description per game
- Publish/unpublish in one click
- bulk publish
- bulk feature actions
- Game page with Play button
- fullscreen
- plays/likes counters
- related games
- comments and report form
Public Site
- Home with featured
- trending
- new and most-loved games
- category tiles and latest blog posts
- Search by title
- summary and tags with sorting (newest
- most played
- most liked
- A-Z)
- Category and tag pages with pagination (games per page configurable)
- Blog with published posts
- static pages (About
- Privacy
- Contact)
- sitemap.xml
- robots.txt
- canonical and social-share meta tags
Visitor Accounts
- Free sign-up with name
- email and password (8+ chars)
- Favourites list
- recently played games (last 12)
- Comments on games (moderated or instant
- switchable)
- Report broken games with reason and optional message
- Account blocking by admin
- last login timestamp
Counters and Tracking
- Plays count once per visitor per game per day (game_plays table with unique key)
- Likes count once per visitor per game (game_likes table with unique key)
- Visitor key is salted hash from IP
- user agent and salt (Visitor::key)
- never stores raw IP
- Counters on games table updated only when a row is created
- inside transaction
- GameService handles all counter changes to prevent inflation
Moderation
- Comments wait for approval (status: pending
- approved
- rejected)
- Approve
- reject and bulk actions in admin panel
- Game reports with reason (does not load
- controls do not work
- inappropriate
- other) and optional message
- Reports list with open/resolved status
- resolve action
- Honeypot field on comment and report forms (bots fill it
- submission is dropped and logged)
- Per-IP throttles: 60 actions/minute for
play/like/favourite - 6 forms/minute for
comment/report/sign-up/sign-in
Ad Slots
- Four positions: top
- game sidebar
- under game
- above footer
- Banner with image and link
- or pasted ad-network code
- Start and end dates for scheduling
- Master switch to enable/disable ads site-wide
- Admin-only (editors cannot manage ad slots)
Admin Panel
- Dashboard with live games
- 14-day plays chart
- likes
- members
- comments waiting
- open reports
- top games
- Roles: admin (everything) and editor (role value 'staff': games
- categories
- tags
- comments
- reports
- members
- posts
- pages)
- Site settings: name
- tagline
- description
- footer
- games per page
- registration
- comments
- moderation
- ads
- game storage mode
- Filament 5 resources split into Schemas (forms)
- Tables (lists) and Pages (create
- edit
- list)
- Every create and edit page returns to the list
Content Management
- Categories with name
- slug
- description
- sort order
- active switch
- Tags with name and slug
- attached to games
- Blog posts with title
- slug
- Markdown body
- published status and date
- Static pages with title
- slug
- Markdown body
- published switch
- Markdown rendered with HTML stripped (Markdown::toHtml)
Demo Mode
- DEMO_MODE=true turns / into a landing page
- portal moves to /arcade
- One-click signed logins for demo accounts (admin
- editor
- member)
- DemoController with roles page and login endpoint
- Prevents changing logins in demo mode
- Eight playable demo games included (Breakout
- Flap
- Memory
- Simon
- Snake
- Tic-Tac-Toe
- 2048
- Whack-a-Mole)
Deployment
- Docker Compose with app (PHP 8.4-apache) and db (MySQL 8.4) services
- HTTP on port 8080
- HTTPS on port 2053 (self-signed cert or custom
origin.pem/origin.key - Optional Cloudflare Authenticated Origin Pull (authenticated_origin_pull_ca.pem)
- Entrypoint runs migrations
- seeds admin
- links storage
- sets permissions
- Volumes for uploads
storage/app/publicand database (dbdata)
Blog and Pages
- Markdown posts with cover image
- draft
- published and scheduled status
- static pages (About
- Privacy
- Contact) with footer links
- safe rendering with raw HTML removed
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| PHP | — | — | Web, API | 76.1% |
| SQL | — | — | Database | 17.2% |
| HTML | — | — | Front-end | 3.7% |
| CSS | — | — | Styling | 2.2% |
| Shell | — | — | Scripts | 0.5% |
| JavaScript | — | — | Front-end | 0.3% |
- Primary language
- PHP 8.3+
- Framework
- Laravel 13 + Filament 5
- Database
- MySQL 8 / MariaDB 10.6+ (SQLite for evaluation)
- Authentication
- Laravel session-based (web + member guards)
- Licence
- Single-site
- Screens
- 23
- Database tables
- 14
- Supported languages
- English only
- Browser support
- Modern browsers (ES6+, CSS Grid, Tailwind 4)
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 512 MB | 2 GB |
| OS | PHP 8.3+, Apache 2.4, MySQL 8 / MariaDB 10.6+ | PHP 8.3+, Apache 2.4, MySQL 8 / MariaDB 10.6+ |
| Est. monthly hosting | $10 | $10 |
```bash cp .env.example .env # set APP_KEY, DB_PASSWORD, SEED_ADMIN_PASSWORD, APP_URL docker compose up -d --build # site at APP_URL, admin at /admin ```
```bash composer install --no-dev --optimize-autoloader && npm ci && npm run build cp .env.example .env && php artisan key:generate # then set DB_*, SEED_ADMIN_*, APP_URL php artisan migrate --seed && php artisan storage:link chown -R www-data storage bootstrap/cache # point nginx at public/ ``` Full steps with nginx and Cloudflare: HowToSetup.md
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (2 minor)
Missing foreign key indexes and some unscoped queries; no injection paths found; strong authz on admin & mutations; minor ownership gaps on member reads. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
