Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For Boardit, the hardest multiplayer problems were not writing game rules or subscribing to database changes. They were deciding which copy of the board to trust, restricting who could see or change each piece of state, and recovering when realtime updates arrived late or not at all. Ahmed Moaz’s account of the project describes six games built with Next.js App Router, Supabase Auth, Postgres and Realtime, and Cloudflare Workers. Its timings and bundle measurements are specific to that project—not guarantees about those services.
What Boardit built—and what this account establishes
Moaz describes a browser-based table for Ludo, Property Rush, Trivia Tavern, Snakes & Ladders, Who’s the Spy, and Draw and Guess. The stack was Next.js App Router with Supabase Auth, Postgres, and Realtime, plus Cloudflare Workers. The account is a first-person implementation postmortem, not an independent audit of the deployed application.
The central design distinction is between authoritative state and the messages that tell clients something may have changed. For Boardit, the database row was authoritative; realtime messages prompted clients to fetch current, authorized data, and polling repaired stale clients when a message was delayed or missed.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow do you keep game rules testable without trusting the client?
Each game had an engine under lib/games/<game>/engine/. An action was applied to the current state with explicit context, and the reducer returned a result. Supplying time and randomness through that context made rule tests reproducible instead of dependent on the wall clock or an uncontrolled random value.
#1 Best Overall
- GAME OF SWEET REVENGE: Enjoy classic Sorry! gameplay with this Sorry! board game for kids. It's an edge-of-your-seat race to home, so hurry up and get there first
- FIRST ONE HOME WINS: Who will be the first player to get all 3 of their pawns to the home space? But watch out! Players can get "sweet revenge" by sending each other's pawns back to the starting point
- SO MANY POSSIBILITIES: Slide, collide, and score to win the Sorry! game. This family game for kids and adults features so many possibilities depending on the card picked up and strategy chosen
- CLASSIC SORRY! GAMEPLAY: Remember playing the original Sorry! game as a kid? Bring back memories of playing the Sorry! game with family members and introduce it to a new generation
- FAMILY GAME NIGHT FAVORITE: A go-to game for family time or anytime indoor fun, the Sorry! game for kids is one of the best family games for game night
Moaz says tests covered edge cases including tied votes, timeouts, rematches, simultaneous correct guesses, and malformed older states. These tests establish how a reducer handles supplied state and actions; they do not establish that a browser is authorized to submit an action or that a persisted state is safe.
The server action still had to decide whether the caller could act, provide trusted time and randomness, and persist the result safely. Pure rules make behavior easier to verify, but they do not replace server-side authorization.
What should a shared board reveal?
Treat the room code as a credential
Moaz treats a short room code as a bearer credential: anyone holding it can try to join. In Boardit, membership checks used the caller’s session-bound Supabase client and row-level security (RLS) for the membership-scoped room lookup. Privileged database access was reserved for cases that required it. The account also says room codes were kept out of analytics and unnecessary debugging output, with internal UUIDs used for analytics identity.
Rank #2
- CATCH THE CHAMELEON: A bluffing board game where players must race to catch the chameleon before It's too late
- ONE SECRET WORD: In this board game for adults and family everyone knows the secret word - except for the player with the chameleon card
- DON'T GET CAUGHT: Use hidden codes, carefully chosen words, and a bit of finger-pointing to track down the guilty player... Before the imposter blends in and escapes!
- EASY TO LEARN, QUICK TO PLAY: Like all good family board games, it takes 2 minutes to learn and only 15 minutes to play. Recommended for 3-8 players and ages 12+
- MULTI-AWARD WINNING: "Best Party Game" At UK games expo. "Seal of excellence" From dice tower games. A perfect board game for adults and teenagers
Keep secrets out of state every player can fetch
For Draw and Guess, the secret word was stored in a separate restricted table rather than the shared board state. A server action fetched it for the drawer. Moaz says he applied the same kind of privacy review to roles and words in Who’s the Spy.
A useful review question is: does every field in this shared object belong to every authorized player? If the answer is no, keep the field behind a narrower access path instead of relying on the interface to hide it.
Guests still need authorization
Boardit used Supabase anonymous auth sessions to give guests stable user IDs for membership checks and RLS without requiring an email address or password before play. That reduced sign-up friction, but brought account-boundary and cleanup work, and a guest returning on another device remained a separate concern. An anonymous session identifies a caller; it does not make that caller authorized for every room or action.
Rank #3
- UNO card game provides classic play, where players match colors or numbers in a race to get rid of all their cards!
- Action Cards and Wild Cards add unexpected excitement and game-changing fun, like the Reverse Card that switches the direction of play!
- The deck includes 3 blank Wild Cards for house rules anyone can make up -- erase and create new rules each game!
- When down to one card, players don't want to forget to yell 'UNO!' Keep score and the first player or team to 500 wins!
- The color blind accessible deck has special graphic symbols on each card to help identify its color, allowing players with any form of color blindness to play!
What happens when a realtime update is late or lost?
Moaz reports that some postgres_changes updates in this project took around five seconds to reach subscribers. The shared-board hook paired the change subscription with a two-second fetch of authoritative state. A monotonically increasing version let clients order deliveries; when a rematch made version zero ambiguous, the client fetched again rather than assuming it had a newer state.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →That combination has a trade-off: polling adds database reads and can make disconnects less immediately visible, but it gives turn-based play a recovery route when a socket goes quiet. A subscription alone is a notification path, not proof that a client has the latest board.
Use Broadcast as a nudge, not as the board
For Draw and Guess, a database trigger sent a Supabase Broadcast nudge on relevant changes. The nudge told clients to fetch authorized data; it did not carry secrets or board contents. Moaz reports that the drawing-channel notifications arrived in tens of milliseconds in this project. Trivia later adopted the pattern, with migration notes reporting roughly 300 ms for Broadcast versus about five seconds for the prior row-change path.
Rank #4
- Play a card from your hand, and place a chip on a corresponding space on the game board - when you have five in a row, it’s a SEQUENCE
- Each player or team tries to score the required number of five-card SEQUENCES before their opponents
- Easy enough for children, challenging for adults!
- Exciting gameplay develops STEM skills like strategy
- Includes 1 Folding Game Board (19.75" x 15.25"), 2 Decks of SEQUENCE Playing Cards (2.25" x 3.5"), 135 Playing Chips (50 Green, 50 Blue, 35 Red), and Complete Instructions
These are observations from Boardit, not service-level guarantees or a general benchmark. Architecturally, the useful separation is that the database holds current state, a realtime message asks clients to fetch sooner, and polling repairs state if a message is late or absent. The browser connected directly to Supabase Realtime; the Worker was not the gameplay WebSocket endpoint.
| Approach | What it does | Trade-off in Moaz’s account |
|---|---|---|
postgres_changes subscription |
Notifies the client of database changes. | Some deliveries in this project took around five seconds. |
| Broadcast nudge plus authorized fetch | Prompts the client to retrieve current data without putting board contents or secrets in the message. | Observed in tens of milliseconds for Draw and Guess; Trivia’s migration notes report roughly 300 ms versus roughly five seconds for its prior row-change path. These are project observations. |
| Notification plus polling | Uses messages for faster refresh and periodic authoritative fetches for recovery. | The two-second poll adds reads and may delay visible disconnect detection, but can repair a stale client. |
How should a game handle a player who stops responding?
Timeouts were game-specific because a missed turn and a player waiting through an auction are different situations. Moaz’s summary is apt: “Timeout policy is game design, not just a setTimeout.”
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsLudo and Snakes & Ladders: expire a turn
These games used 30-second turn clocks. In Ludo, expiry prompted the server to verify its own deadline and choose an obvious legal move: prioritize a capture, getting a pawn home, leaving base, then advancing the furthest pawn. The server validated expiry rather than trusting a client-side clock.
Best Value
- Your goal: try to collect as few points as possible over several rounds of play as quickly as possible by skilfully uncovering, exchanging and collecting playing cards, as few points as possible. But this can only be done as long as a player has not revealed all their cards, otherwise the round of game ends. So be careful, keep an eye on the game and the players
- Great fun for your friends and family. Skyjo is a fun card game that is great fun for children and even large game friends (adults). The card game is very suitable for short games in between and is also an enrichment for a sociable and beautiful game evening.
- Learn playful: calculate - learn to add up to 100 two-digit numbers. Estimate - Get a sense of probability. Concentration - Track game sequences and watch players and their actions.
- Fast game start. Simple, easy-to-understand game principle. Short game instructions with pictures. Ideal for a short game in between as well as as as a base game for fun and exciting game evenings. The game is round-based and can be played flexibly in time.
- Number of players: for 2 to 8 players. Age: from 8 years. Playing time: approx. 30 minutes. Languages: German, English, French, Spanish, Italian. Material: 150 playing cards, 1 game pad, 1 game instructions (English language not guaranteed). Made in Germany.
Property Rush: account for auctions
Property Rush used an inactivity policy with a 30-second grace period, a warning before a 150-second deadline, and a pause while an auction was in progress. When the deadline expired, the inactive player was removed from the table. This policy reflects the fact that a player may already have acted and still be waiting for an auction to finish.
Why did a working local app fail to deploy?
Moaz reports measuring a generated Worker bundle at 3,084 KiB gzipped in 2026, against the 3,072 KiB Cloudflare Workers free-tier limit as described in his account that year. The deployment was rejected for exceeding that limit by 12 KiB. These are his project measurement and his description of the plan limit, not independently verified or necessarily current plan specifications.
The largest identified contributor was dynamic social-image rendering, which brought in roughly 1.5 MB of WebAssembly. Replacing it with a pre-rendered 1200×630 image at public/og.png removed about 279 KiB. Replacing a server analytics SDK with fetch removed another 94 KiB, and an unused icon package was removed. The account says the application now runs on Workers Paid and describes a 10 MiB limit for its setup; check current Cloudflare documentation before using any plan limit for a new deployment.
Recommended Free Tools
The practical lesson is to inspect the generated adapter output rather than infer deployability from a successful local run. Work that never changes—such as a static social image—may not need to execute in the request runtime. The Worker handled rendering and trusted actions; gameplay subscriptions still connected from the browser to Supabase Realtime, so Worker WebSocket capacity was not the mechanism carrying those subscriptions.
What the postmortem does—and does not—show
Moaz’s account shows a coherent design for this turn-based application: independently testable rules, server-checked actions, access-scoped data, notifications that trigger authorized fetches, and polling as a recovery path. It also documents project-specific delays and a bundle-size failure that shaped implementation choices.
It does not independently establish current vendor limits, guarantee the same latency for another deployment, or demonstrate that the application passed a security audit. Treat the timings and bundle figures as Boardit’s reported experience, and verify current platform limits in the relevant vendor documentation before relying on them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
