FAQ - Gurgant/azurebank-v2 GitHub Wiki

Short answers to what an interviewer asks. Each answer rests on a file of the repository.

Is this a real bank?

No. It is a solo portfolio project, deployed only as a public demo with invented data and registration closed. One press of Try the demo gives each visitor a private copy of a bank account, and the copy takes sign-ins for 24 hours. Nothing you do reaches a real account, so do not enter real personal data. More: Try the demo.

Did one person build it?

One engineer did. I am the project's architect and sole engineer: I designed the system, wrote part of the code myself and direct the AI coding agents that write the rest. The project has no outside contributors. The project started in 2025; this repository is its second version, rebuilt and extended from July 2026. The design documents and the earlier history are kept in private repositories. More: About this repository.

How does a change reach main?

Changes go through pull requests gated by CI tests and CodeQL, with AI review, and I merge each one myself. The AI review starts by itself or is asked for on each pull request. An automated suggestion is never applied blindly: each one is checked against the current code first. main requires a pull request, permits squash only, and has no bypass list. More: Merging.

What is the hardest problem in it?

Applying a payment at most once per key, when the network, the browser and the process can each fail halfway. Every money move carries an idempotency key. The server fingerprints the raw request with a keyed HMAC and claims the key before it acts. The client keeps the key after any failure the server might have seen. It held under 24 concurrent duplicates on a real SQL Server. More: ADR-0009.

Why does the browser never get the token?

A token kept in the browser can be stolen by a script that gets injected. So the BFF keeps the tokens in a server-side session and gives the browser an HttpOnly cookie, which the page cannot read. The BFF adds the bearer header itself, and the API accepts no caller but the BFF. Everything is same-origin, so there is no CORS to misconfigure. More: ADR-0001.

How do I know the claims are true?

Each claim links to the record that decides it, and the payment claim to its proof. Every pull request runs the test suites, concurrency proofs on a real SQL Server, the contract suite against the real stack, Schemathesis against the running API, and Playwright with axe. main takes a merge only when the eleven required checks have passed. What was not measured is marked. More: Tests and CI.

How do the frontend and the backend stay in agreement?

The API generates the contract, and a backend test fails when the committed file differs from what the code generates. The frontend's types and validators are generated from that file, and CI fails on any difference. One contract suite runs against both the mock and the real backend. Schemathesis drives the running API and fails on a response the contract does not declare. More: ADR-0053.

What does the project not do?

Passwords are hashed with PBKDF2, which is not memory-hard. The audit chain cannot detect rows deleted from its end. The notice owed when a PIN is enrolled or changed is recorded, and nothing sends it. An idempotency key lives 24 hours: a retry later than that moves money twice. Colour contrast is left to the UI/UX phase. More: Status and known limits.

Why is the first page slow, and what does it cost to run?

The demo is one small replica on Azure Container Apps that sleeps when idle. Measured on 2026-10-06, after it had gone to sleep: 27 seconds until the first page arrived, then 6 seconds for the first sign-in. Awake, a sign-in took 0.6 seconds. A second cold start, on another day, took 24.6 seconds. The database costs $0.161 a day. More: On Azure.

What went wrong along the way, and what changed?

The frontend tests once checked everything against a mock, which had drifted: it answered 422 where the API answers 400. Only the real stack showed it. Since then one suite of assertions runs against the mock and the real API and BFF, and CI starts that stack on every pull request. The traps page lists more: what goes wrong, why nothing reports it, and what to do. More: ADR-0029.

Next page: Story.