NovaBank is a working demo: real passkeys (WebAuthn), a real risk engine, real sessions and no password anywhere in the stack.
How it works
Express API, Postgres, Redis, WebAuthn on both sides, and a risk engine scoring every session.
Passkeys
WebAuthn registration & assertion on every device
Risk engine
Device, location, behaviour and velocity signals
Step-up
OTP or re-confirmation for unusual sessions & large transfers
Session control
Live activity, one-tap revoke from any device