Players will always find the loophole

Deceptive Minds is a social deduction party game for the web. One of its modes is called One Word: everyone gets a secret word except the imposter, and each player gives a one word hint that proves they know it without handing it to the imposter. The whole mode rests on that constraint.

Players broke it within a session.

How to fit a sentence into one word

The original validator did roughly what you would expect. It trimmed the input, checked the length, and rejected anything containing a space. Reasonable. Also completely porous, because a space is not the only way to write a sentence:

it-lives-in-water
it_is_a_fruit
round.and.orange
smellsLikeSummer

Hyphens, underscores, dots and camelCase all sail through a space check while carrying an entire clue. My friends were not cheating in any interesting sense, they were just doing the obvious thing when a rule is stated as “no spaces” instead of “one word”.

Saying what you actually mean

The fix was to stop blacklisting separators and start whitelisting what a word is. A hint is now letters only, or a plain number, with camelCase explicitly rejected:

if (!/^\p{L}+$/u.test(trimmed) && !/^\d+$/.test(trimmed)) return false;
if (/\p{Ll}\p{Lu}/u.test(trimmed)) return false;

The first line allows a run of Unicode letters or a run of digits and nothing else, so every separator dies at once, including the ones I would not have thought to blacklist. The second catches a lowercase letter followed by an uppercase one, which is camelCase smuggling.

The other half of the exploit

Blocking sentences fixed the format. It did not stop a hint from simply being the answer. If the secret is orange, then oranges or orangey is not a hint, it is a surrender.

So the validator also normalises both words and rejects the hint if either string contains the other. Substring in both directions, which covers plurals, suffixes, and the person who types the secret with a letter chopped off and calls it clever.

What I took from it

In a normal app, input validation protects the system. In a social game, input validation protects the fun, which is a much softer and more adversarial target. Nobody is trying to break your database. They are trying to win, and any gap between the rule you stated and the rule you enforced is where the game quietly dies.

Your players are the most motivated penetration testers you will ever have, and they work for free.

The mode is much better now. The hints are worse, which is the point.