Just dropping by to give my 2 cents.
Being a "Provably Fair" game means the player itself could "Prove" that the game session was not tampered in any way.
Let's digest how a game session works according to your help
page1. Before a game session starts
Mine/s location is picked in random and in advance when you create a game. Mine/s Location is based on random_int generator function which picks the mine location from tile 1 - 25 in random.
I would assume
random_int function it is referring to is
https://www.php.net/manual/en/function.random-int.php2. You generate a
truely unique string and concatenate the result of no.1. example:
20-pHZ984WcwT1578416354 where 20 is the result of no.1 plus a "-" and "pHZ984WcwT1578416354" as your unique string.
3. Hash the concatenated string
20-pHZ984WcwT1578416354 via SHA256 which is "7b7373e545db76a277c85d4efc80675b8c32588a1484581ab8b07e0fc372b769" and shows this to the user to "prove" that the game session was not tampered.
4. At the end of the game, you reveal
20-pHZ984WcwT1578416354 so that users can hash it themselves and prove that the hash are the same as no.3.
5. Then starts all over again for every game session.
The implementation may look like solid, but it is not.
No. 1. The user cannot prove that
random_int was indeed used in this step. The user just believes that it is, and this is where the flaw comes in.
You as the house, could pick any number that you would please and the user would never know. If a user has a tendency of always picking the 1st tile, the house could then choose the number 1 for the succeeding game sessions and the user would never know it.
Scenario:
A Whale is playing 3 mines. The house could easily be programmed to watch and analyze the player's "usual" picks, and the house could easily put the mines on those on the succeeding game sessions. This gives an advantage to the house, while the player would never know if he/she was cheated or not. (I'm not saying the op will)
Suggestion:
The mine locations should be generated using a
server secret plus a
client secret this way the house could not cheat or pick the tiles at their advantage.