Engineering
lab.
This site is also my test bench: a pipeline with automatic rollback, chaos engineering, controlled attacks against my own payment gateway. What you see below are the real results, read from the same database the system uses.
Every push runs the tests and reports the result here. If the deploy succeeds but the post-deploy health check fails, the pipeline reverts itself. The repository and its Actions are public: every row links to the real logs.
Every experiment defines what should happen (the defense) and verifies what actually happened. "Passed" means the system defended itself: no duplicate payments, no half-finished states, no orphan events.
Static analysis of dependencies and code, plus accessibility over the public pages, on every push. What counts isn't a green scan but the cycle: every finding is tracked until it's resolved or knowingly accepted.
A gateway of my own with idempotency keys, a state machine with no going back, and webhook signature verification. The counters below are hostile events that arrived and were detected and neutralized, not applied.
Built for my classmates: paste any domain and get, live, 12 tests - security headers, TLS certificate, DNS, domain expiry, robots.txt, sitemap.xml, SEO metadata, basic performance, heuristic accessibility, and a real Lighthouse report via the Google PageSpeed Insights API. Everything is read from public HTTP responses - nothing intrusive - with a limit of 5 scans per minute per IP and anti-SSRF protection (it rejects private or internal-network IPs) so it can't be used as a proxy into someone else's infrastructure.
Site scanner
Paste a domain and watch the 12 tests run live, with streamed results.
Scan a domain →Device fingerprinting
Interactive demo: open a room from two devices and watch them identify each other with no cookies and no login.
Try it live →Monitoring and SLOs
Uptime, p95 latency, and error budget measured by my own check engine.
See /status →Security Operations
My own micro-SIEM: intrusion attempts detected and blocked, in aggregate and live.
See /security →Load testing (k6)
p50/p95/p99 latency under 100–1000 concurrent users against a staging environment.
The data is not screenshots or samples: it is read on the server from the same database (Turso/libSQL) where the pipeline, the experiments, and the gateway write their results. What fails is shown too.
The chaos experiments run with seatbelts on: a 15-minute maximum TTL, critical routes excluded in code, and a kill switch. The whole system is fail-open: a lab failure never takes the site down.
The raw detail (parameters, payloads, active flags) lives in the private panel. What gets published here is the aggregate verdict - enough to verify, without handing over the internal map.