A full-stack digital-asset investment platform built in plain PHP + MySQL — user accounts, deposits, plan-based investing with daily ROI, withdrawals, referrals, notifications, support tickets, and a complete admin back office.
Built as an academic capstone project. No real money, cryptocurrency, or financial instruments are transacted anywhere in this codebase — deposits and withdrawals are simulated and require manual admin confirmation, exactly like a sandboxed teaching environment should.
PDO for MySQL with prepared statements everywhereassets/vendor/, so the site works fully offline with zero external network calls at runtimepassword_hash()/password_verify(), CSRF tokens on every state-changing form, login rate-limiting/lockoutNo Composer, no build tooling, no .env juggling — unzip it into a web root, import one SQL file, and it runs.
lumen-capital folder into your server’s web root (e.g. htdocs/lumen-capital).database/schema.sql (it creates the lumen_capital database itself and seeds demo data).config/config.php and confirm the DB_* constants match your setup. The defaults (root / no password / localhost) work out of the box on a stock XAMPP install.http://localhost/lumen-capital/ in your browser.That’s it — the app auto-detects its own base URL, so it works regardless of what you name the folder.
cd lumen-capital
mysql -u root < database/schema.sql
php -S localhost:8000
Then visit http://localhost:8000/.
| Role | Password | |
|---|---|---|
| Admin | admin@lumencapital.test |
Admin@2026! |
| Investor (with history) | demo@lumencapital.test |
Demo@2026! |
| Investor (referred by demo) | sarah@lumencapital.test |
Sarah@2026! |
The demo investor accounts come pre-loaded with deposits, an active investment, a completed/matured investment, transaction history, and a pending deposit — so the dashboards look “alive” immediately after import, without needing to manually click through every flow first. The admin account starts with a pending deposit and a pending withdrawal already queued up in the review screens.
The core simulation logic lives in cron/process_payouts.php. On each run it:
next_payout_at is due.In production you’d point a real cron job at it:
* * * * * php /path/to/lumen-capital/cron/process_payouts.php >> /path/to/logfile.log 2>&1
For grading/demo purposes, there’s no need to set up cron at all — log in as admin and click “Run Payouts Now” on the Overview page (or admin/run-payouts.php) to process everything that’s currently due, on demand.
This project doesn’t assume you have an SMTP server configured. Instead of failing silently or requiring mail setup, every “email” (welcome messages, password reset links) is logged to a sent_emails table and surfaced in two places:
lumen-capital/
├── admin/ Admin dashboard pages
├── user/ Investor dashboard pages
├── partials/ Shared header/footer/sidebar includes
├── includes/ Core: db connection, auth, CSRF, helpers, bootstrap
├── config/config.php Database credentials & app constants
├── cron/process_payouts.php Daily ROI + maturity engine
├── database/schema.sql Full schema + seed data
├── assets/
│ ├── css/style.css Design system
│ ├── js/app.js Shared front-end interactivity
│ └── vendor/ Locally-hosted Chart.js, Font Awesome, AOS, fonts
├── index.php, plans.php, about.php, faq.php, contact.php Public pages
├── login.php, register.php, logout.php, forgot/reset-password.php
└── README.md
password_hash() (bcrypt); never stored or logged in plain text.HttpOnly/SameSite=Lax.require_login() / require_admin()) gate every protected page server-side — the UI never relies on hiding a link as its only protection.htmlspecialchars() before rendering.This is a software engineering demonstration, not a financial product. Yields, plans, and “crypto” branding are illustrative. Do not connect this codebase to a real payment processor or represent it as a real investment opportunity.