What "source code" should mean: every file readable, the database schema included, and an installer that works without you reverse-engineering it. A surprising amount of what is sold under that phrase is encoded PHP with a licence check in it.
What ships in a real codebase
| Component | What it contains | Why you need it readable |
|---|---|---|
| Mini App front end | The game screens Telegram loads in its webview | Rebranding means editing it |
| Bot handler | Commands, deep links, referral attribution | Where invite codes are captured |
| Game API | Tap submission, upgrades, collection, validation | Where cheating is prevented or is not |
| Database schema | Users, balances, referrals, tasks, withdrawals | Without it you cannot migrate or audit |
| Admin panel | Rates, caps, tasks, users, payouts | Your control surface after launch |
| Payout worker | Signs and batches on-chain transfers | The one place a bug costs real money |
| Installer and cron | Setup and scheduled jobs | Decides whether deployment is an hour or a week |
The stack question
Two broad shapes are sold for this. The difference is not quality — it is what you pay every month and how much you need to know to keep it alive.
| PHP + MySQL | Node + Redis + Docker | |
|---|---|---|
| Hosting | Ordinary shared hosting | A VPS, realistically |
| Monthly cost | A few dollars | Tens of dollars and up |
| Deploy | Upload, run installer, add cron | Build step, containers, process manager |
| Scales to | Comfortably into tens of thousands of users | Higher, with the operational work to match |
| Fix a bug at 2am | Edit the file | Rebuild and redeploy |
For a first launch the left column is almost always right. You can move later, and most projects never need to.
Reading a codebase before you trust it
| 1 | Open the tap endpoint first Find where a tap is submitted. If the client sends a score and the server stores it, everything else is decoration. |
| 2 | Find the rate ceiling There should be an explicit maximum taps-per-second check. Search for it. If it is absent, the leaderboard is forgeable. |
| 3 | Trace one withdrawal end to end From request to signed transaction. Look for where the key is loaded and whether it is encrypted at rest. |
| 4 | Look for a retry guard on payouts A transaction log or an idempotency key. Without one, a failed batch pays some people twice. |
| 5 | Check the schema for referral attribution A single referrer column means one level only. Multi-level needs a tree or a path column. |
| 6 | Grep for eval and base64_decode Both are common in encoded distributions dressed up as source. |
Where the money actually goes wrong
What ShipWeb3 sells here
The Full Telegram Crypto Play-to-Earn Mini App ships as unobfuscated PHP 8 and MySQL — every file readable, schema included, no encoded blobs and no licence phone-home. Scoring is validated server-side with a points-per-second ceiling. Withdrawals are BEP-20 USDT signed from a wallet you own, with the key encrypted at rest. Reward rates, energy caps, referral tiers and tasks are all editable from the admin panel.
Five-step web installer, one cron line, ordinary shared hosting. One-time purchase with free lifetime updates, and we will deploy it for you for an optional fee if you would rather not do it yourself.
Common questions
Readable source, not encoded files PHP 8 and MySQL, schema included, server-side scoring, payouts from your own wallet. See the play-to-earn app |
