MELAIRE Trust & Revenue Console
An abuse-detection and investigation console for a subscription app — detection rules through to evidence, an explainable score and a human decision.
- Detection rules
- Risk scoring
- Postgres
- Next.js

Overview
A trust-and-safety console for my own subscription app. It turns a set of detection rules into an explainable, reviewable investigation workflow — from the signal that fired, to the evidence behind it, to a human decision.
Why I built it
Running a subscription app made me think about the other side of product ownership: what happens when people start gaming the system — trial and refund cycling, promo farming, vote rings, report brigading, moderation gaming. I wanted to see how that behaviour could be detected without treating everything unusual as automatically guilty.
Detection approach
Eight detection rules, written as real SQL, run against the database and cover both platform trust and subscription integrity. Each rule contributes a weight to a capped score that helps prioritise the queue — but the score is only ever a prompt to look, never a verdict. Card data never enters the system; the subscription rules work from lifecycle and platform behaviour.
Investigation workflow
When one or more rules fire, the entity enters a review queue. Opening a case shows exactly which rules fired, the weight each contributed, the supporting evidence, a plain-English rationale and the entity's history. A reviewer records one of three outcomes: confirmed abuse, legitimate, or needs more information.
False positives & human review
A “legitimate” outcome is treated as useful signal, not noise — it means review caught a false positive before anything acted on a real user. The console tracks precision per rule, so a rule that fires a lot but rarely survives review shows up as something to tighten rather than a success.
Technical implementation
Built with Next.js and Postgres, with rules versioned as SQL files and weights kept in a single configuration. The build runs entirely on synthetic data — no real user, financial or card data is present.