Product Surface
Problem
Cybersecurity learning often separates structured threat intelligence from memorable practice. Threatdle uses the shape of a daily puzzle to make actors, malware, and ATT&CK techniques easier to reason about repeatedly.
Solution
The documented workflow ingests MITRE ATT&CK STIX, MISP Galaxy threat-actor data, and curated attack-flow files. A snapshot-keyed SQLite workflow records source materialization, then deterministic puzzle generation creates daily game content with repeat-window controls.
Request Flow
Design Decisions
Server-Side Validation
Guess validation is handled by API endpoints so the answer pool is not simply exposed in the public client bundle.
Deterministic Daily Play
Date-based generation makes the same daily puzzle resolve consistently for different users and devices.
Snapshot Keys
Snapshot metadata gives puzzle content a stable reference to the source material used to build it.
Focused First Game Loop
The first release emphasizes actor, malware, and technique deduction rather than turning every intelligence attribute into a clue.
Live Behavior
The public site and /api/game/today endpoint expose the current puzzle state. The API returns fields including snapshot identity, timezone, server day key, current day key, latest day, and available game days.
Gameplay Boundary
The public site exposes a focused daily game loop: load the active day, review clue material, make a guess, and let the API validate the answer while keeping solution material out of the static client.