Promotional Competition Strategies

There were some key usability and security considerations in developing this as the code that was entered needed to be as short and easy to read as possible, while also maintaining a large enough sample size to avoid guessing codes.

The project brief outlined that 600,000 codes would be required, and needed to be provided to the printing company ahead of the competition so that they could all be printed on the unique entry cards which were added to the product packaging.

We started with all alphanumeric characters for the code, then removed any characters which had a chance to be confused for a different character (I, L, O, 0, 1) which left us with a character set of 31 characters.

By then determining how many guesses could be made by any single user over the lifetime of the competition (1,555,200) and ensuring that the length of the code would mean that there was a statistically impossible chance of guessing a real code (1 in 1.2e15), we settled on a code length of 14 characters plus a check character. To improve readability and entry of the codes, they were then split into three groups of five characters. Resulting in a code format of ABC12-3ABC1-23ABC.

At this point, we wrote a program to generate 600,000 of these codes using a cryptographically secure process to ensure there was no pattern in the generation. These codes were then run through several validation steps to ensure that the generation had been sufficiently random.

The codes – with no indication of which were winning codes - were then provided to the printer to be printed and added to the packaging.

Next, the winning codes were randomly selected from the pool of valid codes, again using a cryptographically secure process to ensure no pattern.

Simultaneously, we built a mini-website in which users would be able to enter their codes to determine if they had won an instant prize and enter the final draw. We were provided with designs by the client, which needed to be realised into a responsive (mobile-friendly) website.

Special care was taken on the code entry form to help minimise any mistakes or issues that users might have when entering the 15-character code. The last character of the entry codes was a check character, which meant that we could provide immediate validation to the user if the code matched the correct structure, without any backend load required.

It was imperative that the website was able to handle bursts in load, as users would likely be entering codes at similar times during the day.

After consideration, we chose to deploy the mini-website through Cloudflare Pages. Cloudflare Pages provides high performance with edge nodes close to users around the world, and zero-step scaling to meet fluctuations in demand. The mini-site was built as a static site with zero dependencies to eliminate potential vulnerabilities.

This static site was then connected via API to a small number of Cloudflare Functions to provide backend processing. This included checking the codes against the list of codes, ensuring that the code had not already been used, identifying instant winners, and sending confirmation emails.

By using this static site and backend API approach the security attack surface can be kept as small as possible, making it easier to avoid vulnerabilities compared with a traditional server-side rendering (SSR) approach.