I gave myself hours I never earned
So here’s the thing this project is really about: Hackatime decides how long you’ve been coding by trusting your computer to tell the truth. Your editor sends little “I’m still working” pings with a timestamp attached, and the server adds up the gaps between them. The catch — it never checks whether those timestamps are real, recent, or physically possible. It just believes them.
Once you notice that, the whole thing falls over. If you control the timestamps, you control the hours. You can hand the server a tidy row of pings and tell it you coded all night. You didn’t. It can’t tell the difference.
I wrote small proof-of-concept scripts for each version of this — fabricating hours out of thin air, forging a long daily streak, and parking myself on the public “currently hacking” board indefinitely — and pointed them at my own account to confirm they actually work. They do. The hours sitting on this profile are the fake ones. That’s the demo.
To be clear about the boundaries: I never redeemed any of it for a prize, reward, or anything of value, and I’m asking the team to wipe my hours so nothing fake survives. The actual scripts stay private — they go to Hack Club officials only, never the public page. The point isn’t to hand anyone a cheat tool; it’s to get this patched before someone less polite finds the same thing.
The good news is the fix isn’t exotic. The server already has everything it needs to catch this — it just isn’t looking yet. More on that in the writeup I’m sending the team.
