Demo · synthetic dataThis is what a substrate-built fintech product looks like running. UI is interactive — click any payment, customer, or mandate to drill in. Data is synthetic but consistent across all views.

← Back to /build

Volume · last 24h

€5,464.69

↑ 12.4% vs previous 24h · 2 tenants

Successful payments

37

77.1% success rate · 4 declined

Active customers

50

across 2 operator tenants

SEPA mandates

16

0 signed today · 0 revoked

Recent payments · last 10

View all payments →
TimeTenantCustomerAmountMethodStatus
12:30:33acme-cocust_b69d1b1...€101.85cardrefunded
12:14:34acme-cocust_3adbe8b...€152.94sepasucceeded
11:30:00acme-cocust_317e596...€32.23cardsucceeded
11:10:14acme-cocust_3adbe8b...€124.11cardsucceeded
10:28:57acme-cocust_b940d72...€175.75cardsucceeded
10:08:26vendor-eucust_6399372...€706.69sepasucceeded
09:33:08vendor-eucust_4f34568...€122.96cardsucceeded
08:52:34vendor-eucust_c2be8fb...€20.13cardprocessing
08:30:07vendor-eucust_df398ad...€28.99sepapending
07:55:43acme-cocust_f31e2a8...€28.34cardsucceeded

Audit trail · last 6 events

View full hash chain →
  1. 12:30
    operator:eve@vendor-euissued refund pi_3PqB3k1ninkrtdmflw · amount=10185 cents
  2. 12:30
    tenant-gateisolation check passed tenant=acme-co · row.tenant_id matches session
  3. 12:30
    stripe.webhookverified signature, ingested pi_3PqB3k1ninkrtdmflw · payment_intent.refunded
  4. 12:14
    tenant-gateisolation check passed tenant=acme-co · row.tenant_id matches session
  5. 12:14
    stripe.webhookverified signature, ingested pi_3PqB9flcgt2t5mbnue · sepa_debit.succeeded
  6. 11:47
    rate-limitrejected request ip=185.220.100.20 · /api/payments · 50/min exceeded

8 corpus-derived tests passing

§47.6 / §65.1 / §66 · provenance per test

The substrate injected these test stubs based on PaySafe's §66 fingerprint. Each traces back to a corpus signature with full audit chain visible at /evidence.

  • expect-chain_sql_parameterized.test.ts

    expect-chain|sql_query.is_parameterized() · CWE-89 · CVE-2024-21305 · §47.6 strength-2 · Wire 1 + Wire 2 fired · public + fix-commit

  • regex-match_webhook_stripe.test.ts

    regex-match|webhook_url|^https://api.stripe.com/ · CWE-918 · CVE-2024-3094 · §47.6 strength-2 · Wire 4 (fingerprint × stripe)

  • membership_path_traversal.test.ts

    !membership|file_path.contains("..") · CWE-22 · CVE-2023-39418 · §65.1 rising-CWE inferred · Wire 2 fired · slope +6.4/mo

  • regex-match_xss_html_escape.test.ts

    regex-match|html_output|escaped · CWE-79 · §47.6 strength-3 jackpot · public + fix-commit + runtime · 4 repos

  • tenant_id_authz.test.ts

    expect-chain|tenant_id.matches(req.session.tenant) · CWE-862 · CVE-2024-44829 · §47.6 strength-2 · multi-tenant default · Wire 1 fired

  • csrf_token_verified.test.ts

    expect-chain|csrf_token.verified · CWE-352 · universal · 23 repos · auth-libs · Wire 1 strength-2

  • tenant_isolation_throws.test.ts

    throws|<<TenantIsolationError>> · multi-tenant · universal · 46 repos · cross-tenant attempts

  • payment_amount_nonnegative.test.ts

    comparison-gte|payment.amount_cents.>=0 · data-validation · universal · 27 repos · §47 baseline