[Submission] TheDavidProtocol – Equis by Awesome06 · Pull Request #5 · ElixirTechCommunity/Stellaris-Hackathon

Awesome06 · 2026-03-28T13:03:53Z

The Problem
Legacy credit bureaus lock out millions of financially responsible, "credit invisible" people simply because they lack a history of debt.

What It Does
Consumers link their bank statements to instantly generate a cash-flow-based Equis Financial Resilience Score.

Why It’s Better
Banks use our deterministic, fair-lending-compliant ML pipeline to safely underwrite these untraditional borrowers. By analyzing real-time income, rent stability, and spending metric, Equis replaces stale credit scores with instant, mathematically rigorous risk assessments, unlocking growth.

Copilot

Pull request overview

Adds a full-stack “Equis” submission with a Next.js frontend scaffold and a FastAPI backend that ingests sample transaction CSVs, categorizes transactions (rules + Gemini), computes a resilience score, and exposes auth/bank/scoring endpoints.

Changes:

Added a Next.js frontend setup (Tailwind/PostCSS, ESLint config, shadcn UI config).
Implemented a FastAPI backend with SQLite/SQLAlchemy models, auth + OTP flow, transaction sync, NLP categorization, and scoring routes.
Added deployment/system design documentation and sample datasets/scripts for training and demo flows.

Reviewed changes

Copilot reviewed 42 out of 564 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
submissions/TheDavidProtocol_Equis/frontend/postcss.config.mjs	Adds PostCSS config for Tailwind
submissions/TheDavidProtocol_Equis/frontend/package.json	Defines frontend deps/scripts (Next/React/Tailwind etc.)
submissions/TheDavidProtocol_Equis/frontend/next.config.ts	Adds Next config stub
submissions/TheDavidProtocol_Equis/frontend/eslint.config.mjs	Adds ESLint flat config using Next presets
submissions/TheDavidProtocol_Equis/frontend/components.json	Adds shadcn/ui components configuration
submissions/TheDavidProtocol_Equis/frontend/README.md	Adds default Next.js README
submissions/TheDavidProtocol_Equis/frontend/CLAUDE.md	Points Claude to AGENTS.md
submissions/TheDavidProtocol_Equis/frontend/AGENTS.md	Adds agent guidance note
submissions/TheDavidProtocol_Equis/frontend/.gitignore	Adds frontend ignore rules
submissions/TheDavidProtocol_Equis/david_protocol_backend_architecture.md	Backend architecture documentation
submissions/TheDavidProtocol_Equis/david_protocol_access_tree.md	Access tree/token mgmt documentation
submissions/TheDavidProtocol_Equis/backend/test_cors.py	Adds local CORS test script
submissions/TheDavidProtocol_Equis/backend/test2.py	Adds local register test script
submissions/TheDavidProtocol_Equis/backend/test.py	Adds local register test script
submissions/TheDavidProtocol_Equis/backend/services/scoring_service.py	Implements rule-based scoring service (and model loader stub)
submissions/TheDavidProtocol_Equis/backend/services/otp_service.py	Implements OTP generation/email + DB persistence
submissions/TheDavidProtocol_Equis/backend/services/nlp_service.py	Implements rules + Gemini-based categorization and summary
submissions/TheDavidProtocol_Equis/backend/services/bank_service.py	Implements CSV-backed transaction sync tied to phone mapping
submissions/TheDavidProtocol_Equis/backend/scripts/train_resilience_model.py	Adds V2 toy training script + artifact saving
submissions/TheDavidProtocol_Equis/backend/scripts/train_models.py	Adds synthetic training script for baseline models
submissions/TheDavidProtocol_Equis/backend/scripts/prepare_samples.py	Generates sample CSVs for demo mappings
submissions/TheDavidProtocol_Equis/backend/routes/scoring.py	Adds pipeline endpoints to compute + fetch scores
submissions/TheDavidProtocol_Equis/backend/routes/bank.py	Adds phone-number “bank connect” endpoint
submissions/TheDavidProtocol_Equis/backend/routes/auth.py	Adds register/OTP/login/me endpoints
submissions/TheDavidProtocol_Equis/backend/reset_db.py	Adds local DB reset script
submissions/TheDavidProtocol_Equis/backend/requirements.txt	Adds Python dependencies
submissions/TheDavidProtocol_Equis/backend/main.py	Creates FastAPI app + CORS + router wiring
submissions/TheDavidProtocol_Equis/backend/generated_transactions.csv	Adds generated sample dataset file
submissions/TheDavidProtocol_Equis/backend/db/models.py	Adds SQLAlchemy models (User/Transaction/Score/OTP/etc.)
submissions/TheDavidProtocol_Equis/backend/db/base.py	Adds SQLAlchemy engine/session setup + get_db dependency
submissions/TheDavidProtocol_Equis/backend/data/9109460397_transactions.csv	Adds sample transactions for one mapped phone number
submissions/TheDavidProtocol_Equis/backend/check_sqlite.py	Adds sqlite inspection script
submissions/TheDavidProtocol_Equis/backend/check_db_v2.py	Adds SQLAlchemy inspection script
submissions/TheDavidProtocol_Equis/backend/check_db.py	Adds SQLAlchemy inspection script
submissions/TheDavidProtocol_Equis/backend/backend/data/8439655313_transactions.csv	Adds nested sample CSV (duplicate path)
submissions/TheDavidProtocol_Equis/backend/Dockerfile	Adds backend container build/run instructions
submissions/TheDavidProtocol_Equis/backend/.env.example	Adds env var template
submissions/TheDavidProtocol_Equis/README.MD	Adds project-level README with run instructions
submissions/TheDavidProtocol_Equis/ML_ARCHITECTURE.md	Adds ML integration guide
submissions/TheDavidProtocol_Equis/FRONTEND_SYSTEM_DESIGN.md	Adds frontend journey and endpoint mapping doc
submissions/TheDavidProtocol_Equis/DEPLOYMENT.md	Adds deployment guide
submissions/TheDavidProtocol_Equis/.gitignore	Adds repo ignore rules

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-28T13:05:50Z

submissions/TheDavidProtocol_Equis/backend/routes/auth.py

+        full_name=user_in.full_name,
+        age=user_in.age,
+        gender=user_in.gender,
+        hashed_password=user_in.password,


Passwords are stored and compared in plaintext (hashed_password=user_in.password and direct equality in login). This is a critical security issue. Hash passwords on registration (e.g., bcrypt/argon2), store only the hash, and verify using a constant-time password verification function during login.

Copilot · 2026-03-28T13:05:51Z

submissions/TheDavidProtocol_Equis/backend/routes/auth.py

+    # 2. Check credentials (using plain text placeholder as requested in previous turns)
+    if not user or user.hashed_password != login_in.password:


Passwords are stored and compared in plaintext (hashed_password=user_in.password and direct equality in login). This is a critical security issue. Hash passwords on registration (e.g., bcrypt/argon2), store only the hash, and verify using a constant-time password verification function during login.

Copilot · 2026-03-28T13:05:51Z

submissions/TheDavidProtocol_Equis/backend/routes/auth.py

+@router.post("/verify-otp")
+def verify_user_otp(otp_in: OTPVerify, db: Session = Depends(get_db)):


If the OTP is invalid/expired (or user not found), the endpoint falls through without returning or raising, which will produce a 200 response with null. Return an explicit error (e.g., HTTPException(status_code=400, detail=\"Invalid or expired OTP\")) for invalid/expired OTPs and handle the 'user not found' case.

Copilot · 2026-03-28T13:05:51Z

submissions/TheDavidProtocol_Equis/backend/routes/auth.py

+
+    if db_otp:
+        user = db.query(User).filter(User.email == otp_in.email).first()
+        if user:
+            user.is_active = True
+            db.delete(db_otp)
+            db.commit()
+            return {"message": "OTP Verified successfully. Account activated."}


If the OTP is invalid/expired (or user not found), the endpoint falls through without returning or raising, which will produce a 200 response with null. Return an explicit error (e.g., HTTPException(status_code=400, detail=\"Invalid or expired OTP\")) for invalid/expired OTPs and handle the 'user not found' case.

Suggested change

if db_otp:

user = db.query(User).filter(User.email == otp_in.email).first()

if user:

user.is_active = True

db.delete(db_otp)

db.commit()

return {"message": "OTP Verified successfully. Account activated."}

# If no valid OTP is found, return an explicit error

if not db_otp:

raise HTTPException(status_code=400, detail="Invalid or expired OTP")

user = db.query(User).filter(User.email == otp_in.email).first()

if not user:

# Optionally clean up the OTP if the user no longer exists

db.delete(db_otp)

db.commit()

raise HTTPException(status_code=404, detail="User not found")

user.is_active = True

db.delete(db_otp)

db.commit()

return {"message": "OTP Verified successfully. Account activated."}

Copilot · 2026-03-28T13:05:52Z

submissions/TheDavidProtocol_Equis/backend/services/otp_service.py

+def generate_otp_code() -> str:
+    return str(random.randint(100000, 999999))


OTP codes are generated using random.randint, which is not intended for security-sensitive randomness. Use the secrets module (e.g., secrets.randbelow) to generate OTPs to reduce predictability.

Copilot · 2026-03-28T13:05:53Z

submissions/TheDavidProtocol_Equis/backend/services/bank_service.py

+                            # 01-01-2025
+                            date_obj = datetime.strptime(date_val, '%d-%m-%p' if len(date_val.split('-')) > 3 else '%d-%m-%Y')
+                        else:
+                            date_obj = datetime.utcnow()
+                    except:


The date parsing format '%d-%m-%p' is invalid for dates like 01-01-2025 and will raise ValueError if that branch is ever hit. Prefer trying a small set of concrete known formats (e.g., %d-%m-%Y, %Y-%m-%d) sequentially, and avoid %p unless the input actually contains AM/PM.

Suggested change

# 01-01-2025

date_obj = datetime.strptime(date_val, '%d-%m-%p' if len(date_val.split('-')) > 3 else '%d-%m-%Y')

else:

date_obj = datetime.utcnow()

except:

# Try common dashed date formats, e.g. "01-01-2025" or "2025-01-01"

parsed = False

for fmt in ('%d-%m-%Y', '%Y-%m-%d'):

try:

date_obj = datetime.strptime(date_val, fmt)

parsed = True

break

except ValueError:

continue

if not parsed:

date_obj = datetime.utcnow()

else:

date_obj = datetime.utcnow()

except Exception:

Copilot · 2026-03-28T13:05:53Z

submissions/TheDavidProtocol_Equis/backend/requirements.txt

+pydantic
+google-generativeai
+scikit-learn
+xgboost


Dependency xgboost is listed twice. Remove the duplicate to keep requirements clean and avoid confusion during dependency management/audits.

Copilot · 2026-03-28T13:05:54Z

submissions/TheDavidProtocol_Equis/backend/requirements.txt

+cryptography
+psycopg2-binary
+joblib
+xgboost


Dependency xgboost is listed twice. Remove the duplicate to keep requirements clean and avoid confusion during dependency management/audits.

Suggested change

xgboost

Copilot · 2026-03-28T13:05:54Z

submissions/TheDavidProtocol_Equis/README.MD

+- **Generic Advice**: Replaces static financial tips with data-driven, Gemini-powered diagnostics that reference a user's *actual* top spending categories.
+
+## 🛠️ Tech Stack
+- **Frontend**: Next.js 15 (App Router), Tailwind CSS, Framer Motion (for premium animations), Lucide React.


Repo README states the frontend uses Next.js 15, but frontend/package.json pins next to 16.2.1. Update the README to match the actual pinned version (or change the dependency pin to match the documented version) to avoid setup and debugging inconsistencies.

Copilot · 2026-03-28T13:05:54Z

submissions/TheDavidProtocol_Equis/.gitignore

@@ -0,0 +1,45 @@
+? # Python


The first line contains a stray ? (? # Python), which is not a valid comment and will be treated as an ignore pattern for the literal ? character. Replace it with a normal comment line (# Python) to avoid unintended ignore behavior.

Suggested change

? # Python

# Python

Awesome06 and others added 4 commits March 28, 2026 18:26

README.MD

8f234b0

Frontend

af8c5df

Fix links and image paths in README.md

8799c12

Update

2f61c41

Copilot AI review requested due to automatic review settings March 28, 2026 13:03

Copilot AI reviewed Mar 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Submission] TheDavidProtocol – Equis#5

[Submission] TheDavidProtocol – Equis#5
Awesome06 wants to merge 4 commits intoElixirTechCommunity:mainfrom
Awesome06:main

Awesome06 commented Mar 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Copilot AI Mar 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		# 2. Check credentials (using plain text placeholder as requested in previous turns)
		if not user or user.hashed_password != login_in.password:

		@router.post("/verify-otp")
		def verify_user_otp(otp_in: OTPVerify, db: Session = Depends(get_db)):

		def generate_otp_code() -> str:
		return str(random.randint(100000, 999999))

-                            # 01-01-2025
-                            date_obj = datetime.strptime(date_val, '%d-%m-%p' if len(date_val.split('-')) > 3 else '%d-%m-%Y')
-                        else:
-                            date_obj = datetime.utcnow()
-                    except:
+                            # Try common dashed date formats, e.g. "01-01-2025" or "2025-01-01"
+                            parsed = False
+                            for fmt in ('%d-%m-%Y', '%Y-%m-%d'):
+                                try:
+                                    date_obj = datetime.strptime(date_val, fmt)
+                                    parsed = True
+                                    break
+                                except ValueError:
+                                    continue
+                            if not parsed:
+                                date_obj = datetime.utcnow()
+                        else:
+                            date_obj = datetime.utcnow()
+                    except Exception:

Conversation

Awesome06 commented Mar 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants