Stumpy Frog Records

The brief

Stumpy Frog Records presses video game soundtracks on vinyl. The site has one job — show each release well and send people to the shop — but the label’s personality is playful and slightly unhinged, and the site needed to feel the same way.

What I built

A release catalog driven by content collections. Every release is a Markdown file with typed frontmatter: catalog number, variants, stock state, Bandcamp embeds and a gallery. The homepage opens on a featured release, with a vertical catalog spine to flick through the rest.

A scene per release. Instead of one theme, each release gets a bespoke animated backdrop that echoes its game: a pond at night for The Wild at Heart, falling glyphs for Caves of Qud, rolling hills for Tiny Glade. Visitors can switch the animation off with a toggle.

A publishing workflow for non-developers. A GitHub Actions form scaffolds a new release with the right frontmatter. Releases can carry an embargo date; a small cron Worker fires a deploy hook every morning so they appear on time without anyone pushing a button.

The easter eggs, and why they needed a backend

The site hides two dozen easter eggs: a Konami code, a playable Breakout that uses the page’s own DOM elements as bricks, a Frogger cursor, a CRT mode, a fly swarm you can eat with the cursor, and a “super dark mode” that takes the term literally.

Some of them unlock real rewards, such as a reserved test pressing. That turns a joke into something worth attacking, so I treated it like any other security problem:

• Rewards live in Workers KV, not in the bundle. The client only reports that an egg was completed; a Pages Function looks up whether it carries a reward. Unknown and unrewarded events get the same empty response, so the client cannot enumerate which eggs pay out.
• Scarce rewards are signed. The server issues a 30-minute HMAC-SHA-256 entitlement token bound to a campaign. It cannot be altered without the secret, and it is consumed by at most one successful claim in D1.
• The claim endpoint is defensive by default. Bounded request bodies, a locked-down response policy, Turnstile verification, and secret rotation that instantly invalidates every outstanding token.

Outcome

The site is live at stumpyfrog.com and carries the label’s full catalog, with new releases added through the same workflow each time.