The original plan
For Day 3 of my 30 Days AI Challenge, I wanted to build something practical: a small public REST API. Nothing fancy — maybe something that wraps a useful dataset or exposes a few Claude-powered endpoints that other people could actually call.
It sounded perfectly sized for a one-day build. I was wrong.
What I ran into
I started scoping it out and the list of "things I'd need to sort out first" grew faster than the actual feature list:
- Authentication & OAuth. Even a basic API needs some kind of auth. Do I roll my own API keys? Use OAuth 2.0? That alone is a half-day of setup and decision-making.
- Cloud hosting. A public endpoint needs to live somewhere — a serverless function, a small VPS, something on AWS/GCP/Railway. None of that is plug-and-play if you're also thinking about uptime and cost.
- Rate limiting. Without it, anyone can hammer the endpoint and run up my bill (or Claude's). Adding it properly means a Redis layer or at least some kind of token bucket logic.
- Security. This is where I really pumped the brakes. A misconfigured API endpoint can expose way more than you intended — injection attacks, SSRF, leaking secrets through error messages. Getting this right takes real care, and getting it wrong in public is embarrassing at best, dangerous at worst.
- CORS, HTTPS, headers. Obvious in retrospect, but each one is another config file and another thing that can break silently.
The honest realization: building a public API correctly — not just working, but secure and production-grade — is not a one-day project. It's a one-week project minimum, and rushing it is how you end up with a security incident.
The pivot
Rather than ship something half-baked and potentially risky, I decided to do something equally technical but fully self-contained: rebuild Contra Stage 1 as a playable browser game, entirely in a single HTML file.
No server. No auth. No cloud bill. No attack surface. Just a canvas, a game loop, and Claude Code helping me think through every system from scratch.
It turned out to be one of the most fun builds I've done. Here's what ended up inside that one file:
- HTML5 Canvas 2D renderer with a parallax forest background
- Full game loop — physics, collision detection, camera system
- 5 enemy types with distinct AI behaviors (walker, shooter, armored, jumper, turret)
- 10 enemy wave spawns across a 4800px scrolling stage
- 3 power-ups: Spread shot, Rapid fire, Barrier shield
- Destructible crates, indestructible barriers, one-way platforms
- A Web Audio API sound engine — no audio files, all synthesized in code
- 3 boss fights, each harder than the last — ending with a dramatic zoom-out into a wider arena
PM lesson I keep relearning: a scoped, shipped thing is always better than an ambitious, unfinished one. The API will happen — but not in a day, and not without doing it properly.
Go play it
The game is fully playable right here. Arrow keys to move, Z or Space to jump, X to shoot. Aim up with the Up arrow. If you make it to the 3rd boss — a flying skull fortress called Crimson Omega — you'll know.