Mike (@mikerb95)CodeByMike
Back
/labVerifiable engineering

Engineering
lab.

This site is also my test bench: a pipeline with automatic rollback, chaos engineering, controlled attacks against my own payment gateway. What you see below are the real results, read from the same database the system uses.

100%
Successful pipelines · 30d
73.9%
Test coverage
21/21
Experiments passed
6
Attacks absorbed (payments)
48.4%
Mutation score
CI/CD pipeline · with health check and automatic rollback

Every push runs the tests and reports the result here. If the deploy succeeds but the post-deploy health check fails, the pipeline reverts itself. The repository and its Actions are public: every row links to the real logs.

OK2ed513b ↗1m 52s · Sep 3, 01:57 PM
OKdd6a01c ↗1m 37s · Sep 3, 11:15 AM
OK1d064d6 ↗1m 33s · Sep 3, 01:56 AM
OK43120dc33m 8s · Aug 30, 08:58 AM
OKc94517c26m 13s · Aug 23, 03:45 AM
OKfca4420 ↗20m 19s · Aug 18, 12:54 AM
OKfc7a23b ↗9m 27s · Aug 18, 12:35 AM
OKb0e603a ↗40m 58s · Aug 16, 01:25 PM
OKe046fa7 ↗9m 27s · Aug 16, 12:01 PM
OKcadccb225m 13s · Aug 16, 03:43 AM
OKcadccb2 ↗111m 43s · Aug 15, 09:21 PM
OK192bffd ↗16m 58s · Aug 15, 07:46 PM
OK0d9b68f ↗14m 36s · Aug 15, 07:36 PM
OKe4331ff ↗9m 12s · Aug 15, 07:27 PM
OK07e55a7 ↗9m 23s · Aug 15, 03:09 PM
Experiments · chaos engineering and controlled attacks

Every experiment defines what should happen (the defense) and verifies what actually happened. "Passed" means the system defended itself: no duplicate payments, no half-finished states, no orphan events.

Approved and declined racing over the same payment2 runs · passedlast: Jul 19, 07:14 PM
Late webhook trying to roll the state back2 runs · passedlast: Jul 19, 07:14 PM
Duplicate webhook (same event twice)2 runs · passedlast: Jul 19, 07:14 PM
Double click on "pay" (concurrent idempotency)2 runs · passedlast: Jul 19, 07:14 PM
Database failure mid payment transaction13 runs · passedlast: Jul 11, 07:33 PM
Security & accessibility · automated analysis

Static analysis of dependencies and code, plus accessibility over the public pages, on every push. What counts isn't a green scan but the cycle: every finding is tracked until it's resolved or knowingly accepted.

45
Open
9
Resolved
0
Accepted
Payment gateway · sandbox

A gateway of my own with idempotency keys, a state machine with no going back, and webhook signature verification. The counters below are hostile events that arrived and were detected and neutralized, not applied.

21
Sandbox payments
2
Duplicate webhooks ignored
4
Out-of-order events contained
0
Tampered amounts rejected
Site scanner · open to anyone

Built for my classmates: paste any domain and get, live, 12 tests - security headers, TLS certificate, DNS, domain expiry, robots.txt, sitemap.xml, SEO metadata, basic performance, heuristic accessibility, and a real Lighthouse report via the Google PageSpeed Insights API. Everything is read from public HTTP responses - nothing intrusive - with a limit of 5 scans per minute per IP and anti-SSRF protection (it rejects private or internal-network IPs) so it can't be used as a proxy into someone else's infrastructure.

Site scanner

Paste a domain and watch the 12 tests run live, with streamed results.

Scan a domain →

Device fingerprinting

Interactive demo: open a room from two devices and watch them identify each other with no cookies and no login.

Try it live →

Monitoring and SLOs

Uptime, p95 latency, and error budget measured by my own check engine.

See /status →

Security Operations

My own micro-SIEM: intrusion attempts detected and blocked, in aggregate and live.

See /security →
Under construction

Load testing (k6)

p50/p95/p99 latency under 100–1000 concurrent users against a staging environment.

How this page works

The data is not screenshots or samples: it is read on the server from the same database (Turso/libSQL) where the pipeline, the experiments, and the gateway write their results. What fails is shown too.

The chaos experiments run with seatbelts on: a 15-minute maximum TTL, critical routes excluded in code, and a kill switch. The whole system is fail-open: a lab failure never takes the site down.

The raw detail (parameters, payloads, active flags) lives in the private panel. What gets published here is the aggregate verdict - enough to verify, without handing over the internal map.