Can I vibe code Shield?

Build a lightweight fraud rule evaluation service using Node.js, Express, Redis, and Postgres.

1. DATA MODEL:
- Create a `sessions` table: session_id, visitor_id, ip_address, user_agent, created_at.
- Create an `orders` table: order_id, session_id, customer_email, total_amount, risk_score, decision (ALLOW, REVIEW, BLOCK).
- Create a `risk_rules` table: rule_id, field, operator, value, weight, enabled.

2. CORE FUNCTIONALITY:
- Expose a POST `/api/v1/telemetry` endpoint accepting client browser attributes (screen resolution, timezone, browser language, user agent) generated by the FingerprintJS frontend SDK. Compute a SHA-256 hash of these attributes to produce a local `visitor_id`.
- Store the session state in Redis with a 30-minute TTL to count checkout velocity per `visitor_id` and per IP subnet.
- Expose a POST `/api/v1/evaluate` endpoint called at checkout submission:
  a. Fetch MaxMind IP risk data (is_proxy, is_vpn, country).
  b. Query Redis for 10-minute velocity counts on email, IP, and visitor_id.
  c. Run dynamic evaluation against active rules in `risk_rules` (e.g., IF proxy=true ADD 40, IF velocity_10m > 3 ADD 30, IF amount > 500 AND new_visitor ADD 20).
  d. Sum weights into a final `risk_score` (0-100). If score >= 70 return BLOCK, if score >= 40 return REVIEW, else ALLOW.

3. FAILURE MODES & FALLBACKS:
- If MaxMind API times out or fails, default to a neutral risk contribution (+0) and log a system alert.
- If Redis is unavailable, fall back to executing Postgres count queries directly without blocking the checkout flow.

4. OUT OF SCOPE:
- Machine learning model training, cross-merchant network aggregation, behavior biometrics (mouse tracking), and native app SDK binaries.

$ each button prefixes agent-specific run instructions · build your own product, never copy proprietary code, trademarks or designs