Where every number comes from.
48 claims from this site, each with the command or the file and line that produced it, read against the repositories on 4 September 2026. Paths that would name a processor, a partner or a client are bracketed. Line numbers drift as the code moves; the date is the honest part.
What the re-read changed is at the bottom. The site said sixteen things the code did not show, and every one was corrected the same day.
The hero and the ledger
This site's own data files, generated from GitHub
| Claim | Evidence |
|---|---|
| 10,989 GitHub contributions in the year to 4 September 2026; 2,250 in calendar 2025 | GitHub GraphQL, viewer.contributionsCollection, default window and the 2025 calendar year. Includes private repositories. Constant in lib/oss-stats.ts, dated. |
| 112 pull requests merged into 93 open-source projects, 18 August to 6 September 2026 | scripts/oss-ledger.mjs → lib/oss.ts, generated 2026-09-06. Filter: is:pr author:dylanpulver is:merged, own repositories and employers' organisations excluded, two listing additions that name an employer excluded by number. |
| 2,203 commits and about 302,000 lines across the three platforms | git log --oneline | wc -l on each repository (914 + 787 + 502); git ls-files | grep -E '\.(ts|tsx|sql|dart|css)$' | xargs wc -l per repository, archive excluded (95,168 + 126,239 + 81,154). |
GoldVault
The payments repository, last commit 21 August 2026
| Claim | Evidence |
|---|---|
| 914 commits, July 2025 to August 2026 | git log --oneline --since=2025-07-01 --until=2026-09-01 | wc -l → 914. First commit 2 July 2025. |
| 95k active lines, TypeScript and SQL, archive excluded | git ls-files | grep -E '\.(ts|tsx|sql)$' | grep -v '^_archived/' | xargs wc -l → 95,168. All tracked including the archive: 137,742. |
| 100 Postgres functions, shipped as migrations | CREATE [OR REPLACE] FUNCTION across supabase/migrations, distinct names → 100 (109 statements, 34 migration files). About a dozen move money; the rest are analytics readers, email triggers, timestamp triggers and helpers. |
| 2 processors behind one adapter, a third slot reserved | grep -rn 'implements PaymentProcessor' lib → 2 files. lib/processors/registry.ts:11-15 registers two and carries the third as a commented line; the slug also exists in a type union and a CHECK constraint. |
| 4 auth mechanisms across three trust tiers | Platform auth in middleware.ts:80; opaque admin session tokens middleware.ts:47-72 with their own table; merchant password login to a signed cookie lib/merchant/auth.ts:6-9; merchant API key compared against a stored hash app/api/embed/sessions/route.ts:44-61. |
| 21 admin screens | git ls-files 'app/admin' | grep -E '/page\.tsx$' | wc -l → 21. |
| Checkout: risk and velocity evaluate the figure that becomes the card charge | app/api/payments/deposit/route.ts:88-92, comment: the guard and velocity must evaluate the actual card charge, not the client-supplied split, otherwise a small declared amount ducks the thresholds. Commit of 5 July 2026 says the same. |
| Identity: the SMS check is required on every deposit and consumed once | app/api/payments/deposit/route.ts:16-18 (required field, with the reason in the comment) and :150-169 (verified, not consumed, then consumed). |
| Risk: a malformed fingerprint is treated as absent, and absence costs 5 against 25 for a shared device | app/api/payments/deposit/route.ts:84-87 (64-hex shape check); lib/guard/RiskScoreService.ts:55-76 (+25 shared device, +5 missing, with the comment saying why omission is penalised). |
| Processor: one adapter interface, per-tenant credentials, weighted routing; a departed processor moved to an archive | lib/processors/types.ts:82 (interface); lib/processors/registry.ts:57-63 (per-tenant credentials) and :88-103 (weighted roll); _archived/README.md:3 (April 2026 stack transition). |
| Processor: the adapter is among the code that changes least | git log --format= --name-only | grep '^lib/processors' | sort | uniq -c | sort -rn → busiest file 8 commits, the interface 1. Repository maximum: a dashboard component at 80. |
| Webhook: deterministic operation id, claim on arrival, release and 503 on a failed credit | lib/processors/webhookOpId.ts:1-11 (RFC 4122 UUIDv5, no dependency); app/api/webhooks/[processor]/transaction/route.ts:106-133 (claim), :175-193 (credit), :139-147 (release and 503). |
| Webhook: unknown tenant and bad signature return the identical response | app/api/webhooks/[processor]/transaction/route.ts:56-75, comment: the difference would be a tenant-enumeration oracle; distinguish only in server logs. |
| Webhook: the signature scheme was pinned from a captured sandbox delivery, and the header lookup is exact-name | lib/processors/[processor]/webhooks.ts:4-7 (pinned from the first real delivery, 16 July 2026, verified by recomputing the digest) and :10-11 (a loose scan also matches the host's proxy signature header). Regression test __tests__/lib/[processor]-webhooks.test.ts:47. |
| Ledger: deny-direct-write policies on the balance table; one legacy function and the policies tested with pgTAP | supabase/migrations/20251114213216_*.sql:27-45 (three policies, FORCE ROW LEVEL SECURITY); supabase/tests/database/001-*.test.sql (13 assertions) and 002-*.test.sql (20 assertions). No test yet over the live payment-rail functions. |
| Ledger: the fee rate is computed in four route handlers, not in the database | grep for the fee expression across app and lib → 4 handlers; the function receives it as a parameter and only checks it is not negative (supabase/migrations/20260523120000_*.sql:42, 49-51). |
| Payout: atomic claim before the processor, release on every failure branch, and the claim that returned nothing | app/api/payments/payout/route.ts:91-108 (claim by affected-row count, with the comment explaining why the returned row was empty for the winner); :138 releaseClaim, called at :153, :162, :188, :210. Commits 4266467 (23 June 2026, the race fix) and 60e618b (7 July 2026, 'payouts were 100% broken'), 1 file, +19 −5. |
| Compliance: a generated controls report with an exhibits section | lib/operator/certificate.ts:3-4 (what the report is); app/admin/api/applications/[id]/certificate/route.ts:84-187 (PDF generation, exhibits from two storage prefixes). The link from a control to its exhibit is editorial, not a field. |
Glitz
The marketplace repositories: app with functions, and web
| Claim | Evidence |
|---|---|
| 787 commits across mobile, backend and web | git rev-list --count origin/main on both repositories → 433 + 354. |
| 83k lines of Dart, 94 screens | find lib -name '*.dart' | xargs wc -l → 83,242 in 262 files; files named *_screen.dart or *_page.dart → 94. |
| 59 Cloud Functions | grep -E '^export const \w+ = on[A-Z]' functions/src/index.ts functions/src/[storefront]/*.ts | wc -l → 59 (48 + 11). |
| 89 web pages against the same database | find src/app -name page.tsx | wc -l → 89 in the web repository. |
| 58 mobile builds shipped | pubspec.yaml on origin/main: version 1.0.0+58. No tags; the build number is the record. |
| 34 Maestro flows, screenshot helpers included | find .maestro -name '*.y*ml' | wc -l → 34, of which five or six are screenshot and navigation helpers. |
| Rules: 696 lines, nine helpers, the participant check written three times | wc -l firestore.rules → 696. Helpers at :9-83 and :676. Conversation rule :185-195; message subcollection :197-211 with the comment about collection-group queries; the unused top-level collection locked at :214-222. |
| Rules: a grant is refused, a removal is allowed; a guest can create only a guest profile | firestore.rules:21-29 (create), :31-42 (grant vs removal, with the reason: the mobile build writes the whole document), :51-65 (owner edits); :16-19 (anonymous sessions excluded from writes); :92-104 (guest profile key list). |
| Rules: 35 checks under the emulator, no CI | scripts/test-firestore-rules.mjs, 35 check() calls; runs only by the emulator command in its header comment (:13-16). No .github directory, no test script in any package.json. |
| Hold: thirty days, a daily release, an hourly retry with a doubling ladder, a half-hourly reconciler | functions/src/index.ts:2118-2149 (holdDays = 30, also a literal in functions/src/[storefront]/webhooks.ts:738-742); :3578-3601 (release, 06:00 daily, 50 per run); :3771-3798 (retry, hourly, fewer than five attempts) and :3871-3874 (3600 × 2^(n−1)); :3891-3928 (reconciler, every 30 minutes, entries idle over 30 minutes). |
| Hold: the balance monitor is a flat threshold | functions/src/index.ts:3944-3988: daily at 08:00, default 500, read from a config document; writes an alert. It does not sum held entries. |
| Charge: a deterministic document id closes the check-then-add race | functions/src/index.ts:2160-2163, comment: two concurrent calls for the same sale cannot both create an entry; the second create throws ALREADY_EXISTS. |
| Link: the rate is capped at the brand's product commission every time it is read for money | functions/src/index.ts:1945-1948 (why the collaboration rate is never trusted above the product's), :1992-1998 (cap, with the trade-off against the seven-day grace written beside it), :2081-2083 (cap on the team branch). |
| Team: routed through the team automatically, split read from the membership record, clamped to 0..100, solo and team exclusive | functions/src/index.ts:2042-2051 and :2098 (auto-route, earliest membership wins); :2547-2567 (split from the membership document, clamp); :2569-2586 (exclusivity rule and its error). |
| Catalogue: one storefront integration in one directory | functions/src/[storefront]/: 3,493 lines in five files, 11 of the 59 functions; HMAC on OAuth (oauth.ts:196-205) and on webhooks (webhooks.ts:51-59); daily reconciler sync.ts:302-316. |
MicroGym
The gym repository
| Claim | Evidence |
|---|---|
| 502 commits, all one author | git log --oneline | wc -l → 502. |
| 81k lines across 344 files | git ls-files | grep -E '\.(ts|tsx|sql|css)$' → 344 files; | xargs wc -l → 81,154. |
| 34 tables | Keys under Tables in lib/supabase/database.types.ts → 35, one of them a keep-alive utility table. Types last regenerated July 2026. |
| 1,507 lines in the substitution engine | wc -l lib/services/assessment-substitution-service.ts → 1507. Fourteen exports, three with a caller outside the file. |
| 4 phases of security hardening, each reversible | db/rls-hardening/phase1.sql to phase4.sql, each with a _rollback.sql that reverses it; all eight recorded in commit 03c50cd, 24 July 2026. |
| 4 to 0 rows a member could see that were not theirs | db/rls-hardening/phase1.sql:3, comment: verified via impersonation, member leaked 4→0. Recorded for phase one; the later phases carry no verification line. |
| Assessment: newest wins, a same-date tie keeps the first, and the comment says arbitrary but consistent | lib/services/assessment-substitution-service.ts:446-467. The rule query at :359-368 has no ordering clause. |
| Roster: the Epley estimate, then the movement's default for the member's strength level | lib/utils/one-rep-max.ts:4-14 (Epley), :16-32 (inverted and rounded to five); lib/utils/suggested-performance.ts:45-92 (history first, defaults second, substitute movement's defaults when a substitution is active). |
| Live: milestone checks fire without being awaited from the performance write | lib/services/move-performance-service.ts:199-219 (not awaited, errors to console); lib/services/milestone-service.ts:453-456 (must not block the write). |
| History: aggregates in application code, with the ceiling named | lib/services/member-kpi-service.ts:13-20, comment: fine at this scale, a member has tens of rows; move to an RPC or view at tens of thousands. |
| Library: fifteen strength-default fields on every movement | lib/supabase/database.types.ts:953-983, grep -cE '(low|medium|high)_strength_' → 15: three levels × reps, weight, weight unit, duration, duration unit. |
| No tests and no CI | No *.test.* or *.spec.* files, no test runner in package.json, no .github directory. |
What the re-read changed
A page that claims every number comes out of a repository should show what happened when the repositories were re-read. These are the sentences the site got wrong, and what the code showed instead. They were fixed on 4 September 2026.
| The site said | The code shows |
|---|---|
| Three processors behind one adapter. | Two implementations; the third is a reserved slug and a commented-out registry line. |
| Three auth systems, one per trust tier. | Four mechanisms across three tiers; the merchant tier has an interactive login and a server-to-server key. |
| 22 admin screens. | 21 route pages; 22 counted a layout file. |
| 82k lines of TypeScript and SQL. | That count excluded nearly all the SQL. 95k with only the archive excluded. |
| The ledger functions are tested with pgTAP. | One legacy function and the balance policies are. The live payment-rail functions are not yet. |
| The adapter is the file that changes most. | The interface has one commit; the busiest adapter file eight; the busiest dashboard screen eighty. |
| The risk check moved later in the flow, after the processor answers. | Nothing moved. One variable changed; the check still runs before the processor is called. |
| A loose header scan is a current cost. | Removed on 21 August 2026; it survives as a warning comment next to the exact-name lookup. |
| The one-rep-max estimate's drift is stated where it is used. | No such comment exists. The formula is Epley; the caveat is now on this site, not in the code. |
| Every policy asks the security-definer helper. | Three of the eight created policies check a column or a single subquery inline. |
| Each hardening phase was verified by impersonation. | The count is recorded for phase one only. |
| A second storefront would be a second adapter, not a second project. | No adapter seam exists; the integration is confined to one directory and the storefront's name is in the collection names and the rules. |
| 35 Maestro flows, 88 web pages, 57 builds, 755 commits. | 34, 89, 58, 787, read from origin on 4 September 2026. |
| The tenant is found from a header. | From the one field in the unverified body it can be looked up by; only the signature is in a header. |
| Every rule about how money moves is written once in the database. | Every movement is; the fee rate is computed in four route handlers. |
| A customer email goes out after a payout. | The template exists and nothing calls it. |