A Serverless Remote List for "More Games": One JSON File on GitHub Pages

By Nesim Razon, independent Android developer · 2026-11-14

#Dev notes#Android

Each of my games has a "More games" window that promotes the others. For a while that list was baked into every app, which meant that releasing a new game forced an update of all the old ones. I replaced it with a single JSON file on GitHub Pages. Here is how it works and which limits keep it safe.

The problem with a list inside the app

A list built into the app is easy to write and painful to maintain. Every new game meant new code, new icons and a new release for each older game, and each of those releases goes through review. With about a dozen games, the promotion window was the slowest part of every launch.

One file on GitHub Pages

The list is now a static file next to my website, plus one small icon per game. Each entry has a short key, the game name, the Android package name, an icon path and one description per language. The apps read the descriptions in the phone's language and fall back to English.

A small script builds the file. It holds one line per game, resizes each icon to a fixed small size and writes everything. Adding a game means adding a line, running the script and pushing. None of the older apps needs a release for that.

How the app uses it

At most once every 48 hours the app downloads the list in a background thread and stores it on the phone. The window always reads the stored copy. If the phone has never been online, or the file is damaged, the app falls back to a copy of the list and the icons that ship inside the app itself.

An entry whose icon is not available is skipped instead of showing a grey square, and the game never lists itself.

Checks that keep it safe

The list can only open a store page, but I still treat it as untrusted input.

• Downloads are accepted only over https and only from my own site.
• The list may not be larger than 64 KB and an icon may not be larger than 256 KB.
• At most 40 entries are read.
• Each key and each package name must match a strict pattern before it is used.
• A damaged file never replaces a working one: parsing errors fall back to the bundled copy.

Writing in the right order

The app first downloads and saves the icons, and only then saves the list file. That way the stored list never points to an icon that is missing. When the new list is saved, a small counter changes so that an open window refreshes itself, which fixed the case where the very first opening showed an empty window.

What I would still change

A new game appears after the next refresh, which can take up to two days plus the next time the window is opened, so it is not instant. The list has no usage counting of its own; clicks are counted by the apps. And everything depends on one host, which is why the bundled fallback matters.