Playful Bot-Gate
A friendly mini-game human check for your forms — the answer is verified server-side and a single-use signed token gates the submit. A novelty/engagement gate, not a security wall.
Why This Exists
A small mini-game (count the shapes, find the ducks) as a friendlier alternative to a checkbox CAPTCHA. The scene is rendered server-side to a flat image, so the browser receives pixels and an opaque challenge id — never the shape list or the answer. The solution is graded server-side, and on success the server mints a single-use, expiring, HMAC-signed pass token your form redeems. Be clear-eyed: a puzzle a human solves in the browser is automatable by a determined attacker, and low-difficulty challenges have a small answer space — this is a novelty/engagement gate, NOT a substitute for real bot mitigation. Your rate limit is the real limiter.
Features
Friendly Mini-Game
A count/find puzzle instead of a squint-at-text CAPTCHA
Answer Stays Server-Side
The scene is a flat image; the answer is never in the payload
Single-Use Signed Token
An HMAC pass token, atomically burned on redemption
Drop-In Component
A Blade component for same-origin forms, or a standalone iframe
What You Get
How It Works
Issue a Challenge
The server picks a puzzle, stores the secret answer keyed by an opaque challenge id, and renders the scene to a flat image.
Human Solves It
The visitor submits only their solution (a number, or tapped points). The browser never receives the answer or the shape list.
Grade + Mint Token
The server grades the solution and, on success, mints a single-use, expiring, HMAC-signed pass token bound to that challenge.
Redeem on Submit
Your form redeems the token; the server atomically burns it so it cannot be replayed.
Technical Details
The scene is rasterised with GD to a flat PNG; the payload carries pixels + an opaque cid only. Grading runs server-side.
HMAC-SHA256 signed, expiring, single-use. Redemption is an atomic compare-and-set, so a solved token cannot be redeemed twice.
A same-origin Blade component, or a standalone iframe that posts the token to a configured parent origin (never "*").
Low-difficulty challenges have a small answer space and fresh challenges reset difficulty — treat rate limiting as the real limiter. Not a security control.
Frequently Asked Questions
Playful Bot-Gate
A friendly mini-game human check for your forms — the answer is verified server-side and a single-use signed token gates the submit. A novelty/engagement gate, not a security wall.
A live preview running the real package. The product itself is downloadable source you self-host on your own site.
This product isn't available for purchase yet.
Item Details
We build the tools we sell. Every product is extracted from our own production systems.
Book a call for custom workMore from Blorp Blorp Market
AI Contact Form
An intelligent contact form that qualifies leads, blocks spam, and drafts responses — powered by your own OpenAI key.
Resilient LLM Router
A multi-provider LLM client with automatic failover and one consistent JSON schema across Groq, Gemini, OpenAI, and Anthropic — powered by your own keys.
Creator Affiliate Storefronts
A multi-tenant, keyed Amazon affiliate platform — your site earns on the house tag while each approved creator earns on their own. Drop-in Laravel, bring your own Associates tags.
Embeddable AI Chatbot Widget
A one-script embeddable AI chat widget with a bring-your-own-key Laravel backend. Your OpenAI/Anthropic key stays on your server.
AI Citation Verifier
Submit claims with the source URLs that back them; each source is fetched behind an SSRF guard and graded by an LLM as Supports / Partially / Contradicts / Irrelevant. Bring your own key.
Document e-Sign Kit
A self-hosted e-signature core for Laravel: per-signer magic-link click-to-sign plus a hash-chained, tamper-evident audit trail you can re-verify. No third-party provider.
Project Scope Estimator
A deterministic, multi-step project scope + price/time estimator with optional lead capture. Ships as both a Laravel package and a self-contained vanilla-JS widget. No AI required.
LLMO / llms.txt Kit
Generate a correct llms.txt and AI-crawler robots groups for your site, plus a heuristic LLM-readiness report. SSRF-guarded, bring-your-own-key optional copywriting.
Brand Palette + WCAG Contrast Utility
A pure-PHP utility that computes WCAG contrast ratios from your brand colors and tells you which pairings pass AA / AAA — with accessible pairing suggestions. No AI, no network.
Styled QR Generator
A stateless engine that renders branded SVG QR codes — module styles, frames, gradients, and an embedded logo — with pluggable payload encoders (url / wifi / vcard / geo / text).
Occupancy / Capacity Counter
A concurrency-safe, append-only manual headcount ledger — lock-safe in/out events, zero-clamped, that warns then flags when a configurable capacity is exceeded. Counts people without identifying them.
Credential Expiry Roster
A roster report that buckets worker credentials into EXPIRED / EXPIRING-SOON / UNDATED (an undated credential is a gap, not "fine"). Records operator attestation — it does not verify credentials against any issuer.
Laravel Calculator Suite
A headless pack of 27 real, working calculators (financial, health, home, utility) behind one BaseCalculator contract, a pure-PHP registry, and a sanitized /calculate JSON endpoint. Estimates only — every one ships a disclaimer.
Need This Customized?
We built this product. We can customize it for your specific needs, integrate it with your systems, or build something entirely new.