Mike (@mikerb95)CodeByMike
Back
/labVerifiable engineering

Engineering lab.

This site is also my test bench: a pipeline with automatic rollback, chaos engineering, controlled attacks against my own payment gateway. What you see below are the real results, read from the same database the system uses.

Every experiment defines what should happen (the defense) and verifies what actually happened. "Passed" means the system defended itself: no duplicate payments, no half-finished states, no orphan events.

Test benchreplayDouble click
Browser2 checkouts, same key
Gatewaywebhook
Chaoschaos
1Unique keyk-7f3a exists: returns PAY-0001
2Event already seenpayment_events
3Legal transitioncanTransition()
4VersionWHERE version = ?
5Transactiondb.transaction()
Payment
created
pending
approved
declined
Payments in DB
1
State
created
Version
v0
Events applied
0 of 0
Expected

One payment in the database, and both clicks get the same reference.

Passed2 runs · last: Jul 19
Replayed in your browser with the real state machine (payments-state.ts). The stamp and the runs come from lab_experiments: if a real run fails, the stamp says so.
Successful pipelines · 30d
100%
Test coverage
56.6%
Experiments passed
21/21
Attacks absorbed (payments)
6
Mutation score
53.8%
CI/CD pipeline · with health check and automatic rollback

Every push runs the tests and reports the result here. If the deploy succeeds but the post-deploy health check fails, the pipeline reverts itself. The repository and its Actions are public: every row links to the real logs.

  1. dab7259 ↗OK2975 tests · 56.6% cov5m 27s · Oct 19, 08:40 PM
  2. c342dae ↗OK2975 tests · 56.6% cov3m 27s · Oct 19, 08:36 PM
  3. 4e0e42e ↗OK2975 tests · 56.6% cov2m 45s · Oct 19, 08:29 PM
  4. d9bd044 ↗OK2976 tests · 56.7% cov6m 11s · Oct 19, 08:12 PM
  5. 80aab9f ↗OK2976 tests · 56.7% cov3m 43s · Oct 19, 08:02 PM
  6. df39158 ↗OK2976 tests · 56.7% cov2m 57s · Oct 19, 07:58 PM
  7. cc8fee4 ↗OK2963 tests · 56.5% cov2m 25s · Oct 8, 03:53 PM
  8. 5978e8a ↗OK2959 tests · 56.5% cov1m 47s · Oct 6, 08:48 PM
  9. 15cead3 ↗OK2943 tests · 56.3% cov14m 21s · Oct 6, 08:40 PM
  10. eaf606b ↗OK2938 tests · 56.2% cov4m 14s · Oct 6, 07:48 PM
  11. cab51bc ↗OK2923 tests · 56.3% cov2m 11s · Oct 6, 07:37 PM
  12. 90c526a ↗OK2889 tests · 54.9% cov4m 1s · Oct 6, 07:03 PM
  13. 9d80e2c ↗OK2887 tests · 54.9% cov2m 12s · Oct 6, 06:59 PM
  14. e8c0dec ↗OK2885 tests · 55.7% cov2m 36s · Oct 6, 06:44 PM
  15. 0408f69 ↗OK2885 tests · 55.7% cov2m 54s · Oct 6, 06:41 PM
Security & accessibility · automated analysis

Static analysis of dependencies and code, plus accessibility over the public pages, on every push. What counts isn't a green scan but the cycle: every finding is tracked until it's resolved or knowingly accepted.

52Open
every finding starts here
91Resolved
0Accepted

1 dot = 3 findings

Load testing

A rising load ladder against a disposable environment until it finds the point where the system breaks and how long it takes to come back once the load stops. Measured on the plateau, not the ramp: averaging both mixes a healthy level with a saturated one.

offeredserved without errorp95
Sustained, no errors
50/s
Breaking point
200/s
Recovery
75s
Run p95
10.0s
Payment gateway · sandbox

A gateway of my own with idempotency keys, a state machine with no going back, and webhook signature verification. The counters below are hostile events that arrived and were detected and neutralized, not applied.

Sandbox payments
23
Duplicate webhooks ignored
2
defense 2 · Event already seen
Out-of-order events contained
4
defense 3 · Legal transition
Tampered amounts rejected
0
defense Amount check
Site scanner · open to anyone

Built for my classmates: paste any domain and get, live, 12 tests - security headers, TLS certificate, DNS, domain expiry, robots.txt, sitemap.xml, SEO metadata, basic performance, heuristic accessibility, and a real Lighthouse report via the Google PageSpeed Insights API. Everything is read from public HTTP responses - nothing intrusive - with a limit of 5 scans per minute per IP and anti-SSRF protection (it rejects private or internal-network IPs) so it can't be used as a proxy into someone else's infrastructure.

Site scanner

Paste a domain and watch the 12 tests run live, with streamed results.

Scan a domain →

Device fingerprinting

Interactive demo: open a room from two devices and watch them identify each other with no cookies and no login.

Try it live →

Monitoring and SLOs

Uptime, p95 latency, and error budget measured by my own check engine.

See /status →

Security Operations

My own micro-SIEM: intrusion attempts detected and blocked, in aggregate and live.

See /security →
How this page works

The data is not screenshots or samples: it is read on the server from the same database (Turso/libSQL) where the pipeline, the experiments, and the gateway write their results. What fails is shown too.

The chaos experiments run with seatbelts on: a 15-minute maximum TTL, critical routes excluded in code, and a kill switch. The whole system is fail-open: a lab failure never takes the site down.

The raw detail (parameters, payloads, active flags) lives in the private panel. What gets published here is the aggregate verdict - enough to verify, without handing over the internal map.