Shipping daily
Nov 1DATAAll 646 projects re-verified: 6,419 developer claims tested against registers, courts and pressNov 1DATAMalaysia TEDUH and Philippines DHSUD licence checks: expired licences and approved delays foundNov 1DATAThailand ONEP register: 2 condos found selling before environmental approvalNov 1DATAMexico PROFECO contract register checks: one sales registration belonged to a laundryNov 1DATAAbu Dhabi ADREC inspections and RAK RERA permit list added: % built straight from the regulatorNov 1SHIPPEDNew stage filter: completed but still sellingNov 1SHIPPEDPublic database page: verification levels, disclosure distribution, every marketNov 1DATA+212 projects in one day, round 3: USA, Caribbean, Gulf, Africa, Japan, AustraliaNov 1SHIPPEDStage on every case: off-plan or under constructionOct 31SHIPPEDVerification level per check on every case card: registry, independent, developer, contradicted
Changelog →

Kolaboro / Engineering / Reliability

Reliability

A small team has to find its own problems before a buyer does. These checks run without anyone pressing a button, and most publish their results.

Loading live results…

Every day

  • End-to-end self-test in the production database: sign up, log in, open a case, message, payment confirmation, password reset, share link, saved project, and the rules that must refuse things (small amounts, unverified emails, unrelated payments). Everything it creates is rolled back. Result on /status.
  • Page crawl of every public page on a phone and a desktop: broken links, script errors, failed files, sideways scrolling, plus accessibility checks (axe-core, WCAG 2 AA) and speed budgets on key pages.
  • Scores reproduced: every Trust Score is recomputed from the open data with the open scoring code (/open/scoring.py) and must match what we publish.
  • AI evaluation: see the daily evaluation.
  • Backups of the database and every evidence file, by SHA-256.

Every week

  • Restore drill: the newest backup is loaded into an empty Postgres database, every table's row count and content hash must match the backup, and every evidence file must hash to its name. A backup you have never restored is a hope, not a backup. Result: /data/restore.json.

All the time

  • Uptime: the home page and the API health check are probed every 5 minutes from our database server, outside Cloudflare. /api/open/uptime.
  • Errors in visitors' browsers are reported to us (page path, message and script origin, nothing personal) with a daily digest by email.
  • Scripts: third-party libraries load with Subresource Integrity, so a changed file is refused, and a script allowlist runs in report-only mode so we see any unexpected script before we enforce it.
  • A second vantage point: GitHub's runners probe the site every hour and report with a short-lived token signed by GitHub (OpenID Connect), which our server verifies. No password is stored anywhere for it.
  • Data freshness: the objective is 90% of projects re-read from their source within 7 days, measured per market on /status and at /api/open/freshness.
  • Decoy credentials: a fake admin key and a fake API key are planted where only someone looking for secrets would find them, plus a decoy path in robots.txt. Nobody legitimate ever uses them, so any use alerts us at once.
  • Weekly security scan: OWASP ZAP scans the site every week (passive baseline); the summary by risk level is on /status.
  • Signed case files: every PDF the portal creates is registered with its SHA-256; anyone can check a PDF on /verify.
  • Which code answered: every open API answer names the build commit (header x-kolaboro-build, and /api/open/build).
  • Admin actions go into a hash-chained audit trail whose head is in the public log.

More from Engineering: AI that can't be talked into a verdict · Daily AI evaluation · The public log · Signed site photos · Reliability

Protect my purchase