diff --git a/.gitignore b/.gitignore
index d3a3066..07202b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@ coverage.txt
 
 # Demo content (hosted on CDN)
 demo-track.smsg
+!pkg/player/frontend/demo-track.smsg
 
 # Dev artifacts
 .playwright-mcp/
diff --git a/php/borg-stmf/src/STMF.php b/php/borg-stmf/src/STMF.php
index 3d2550f..683636f 100644
--- a/php/borg-stmf/src/STMF.php
+++ b/php/borg-stmf/src/STMF.php
@@ -271,13 +271,8 @@ private function xorDeobfuscate(string $data, string $entropy): string
         }
 
         $keyStream = $this->deriveKeyStream($entropy, strlen($data));
-        $result = '';
 
-        for ($i = 0; $i < strlen($data); $i++) {
-            $result .= chr(ord($data[$i]) ^ ord($keyStream[$i]));
-        }
-
-        return $result;
+        return $data ^ $keyStream;
     }
 
     /**
diff --git a/pkg/player/frontend/demo-track.smsg b/pkg/player/frontend/demo-track.smsg
new file mode 100644
index 0000000..bea2ea0
--- /dev/null
+++ b/pkg/player/frontend/demo-track.smsg
@@ -0,0 +1 @@
+placeholder for build
\ No newline at end of file