Replacing a payment rail under a live storefront

Four projects moved this week. Two of them are worth walking through properly.

Swapping the rail without a checkout going dark

Hans Rooseboom Art has run dual checkout since launch — Stripe for international buyers, Payfast for South Africa. This week the South African leg became Paystack instead, and the reason is worth stating plainly: Payfast verifies webhooks with a form-POST plus an MD5 signature. Paystack verifies with an HMAC-SHA512 hash of the raw request body. One of those is a scheme from an earlier era of the web; the other is what you'd design if you were starting today.

The swap had one hard constraint: nothing could break the international Stripe leg, which was untouched and verified byte-for-byte against the pre-change version. The South African branch had actually been built earlier on a separate branch and just needed rebasing onto main — renumber the migration so it applies after two others that shipped in between, let database.types.ts merge the new paystack enum value alongside what was already there, done. Cherry-picking a finished branch onto a moving target beats rewriting the same logic twice.

The site's own README states the money rules this had to keep holding: the client never sends a price — every amount is looked up server-side at checkout. Only a signature-verified webhook can mark an order paid; landing on the success URL proves nothing. The captured amount is re-checked against the order total before anything flips to paid. None of that changed. What changed is which signature scheme is trusted to trigger it — and now it's the stronger one.

The same week the site's content stopped being scaffolding. The About page had been a placeholder since launch, flagged in the README as blocking. It's now a real first-person artist statement and biography, written from Hans's own notes — no invented exhibition history, no fabricated collector figures. A Price-on-Application tier went in for premium originals, and a thematic-collections feature groups works by theme with its own index page. A gallery only sells once the wall behind it is real.

ColourIQ grows an admin brain

ColourIQ has run as a tablet kiosk since the Mall of Africa activation — a stylist photographs a guest, the app matches a trend colour, the guest walks away with a shareable result card. What it didn't have was a way to see what any of that added up to. This week it got one: /dashboard now shows period, colour and source filters, stat tiles for sessions and WhatsApp sends, a trend-colour split, by-hour and by-day charts, and a filtered session table with CSV export.

The dashboard reads from the same privacy model the kiosk already had — no photo is ever uploaded or stored, only { timestamp, season, colour, overridden } per session — so aggregating it into charts didn't require loosening anything. What did get added is a WhatsApp send: a guest can now opt in, at send time, to have their result texted to their own phone. Declining still sends the message; the number is just never kept. It's the same instinct as the checkout webhook above, in miniature — the feature only works if the thing enforcing the promise sits in the one place the data actually flows through.

Elsewhere this week

FieldForce SA did a launch-readiness pass — POPIA-aware Terms and Privacy pages, a required consent checkbox gating both email and Google signup (the old one-click Google shortcut is gone, since it bypassed consent entirely), and an allowlist fix so Paystack's webhook can actually reach the subscription-renewal route instead of being 401'd by the session gate first. FundReady SA rewrote its homepage for conversion, added SEO guides for the NYDA and SEFA funding routes, and finished the loop it started two weeks ago — a real payment-success page now sits at the end of the Paystack redirect instead of a dead end.

None of these four are new features you'd screenshot for a highlight reel. They're the parts that make the ones you would screenshot trustworthy: the signature scheme underneath the checkout, the consent checkbox before the signup, the dashboard that turns raw sessions into something a client can actually read.