Colophon

Built like production.

This site is a small production system, held to the standards I apply at work: every change goes through security gates, performance budgets, and automated checks before it ships.

This site's delivery pipeline

01
Commit
- Pull request
- Branch protection
→↓
02
Build
- Lint
- Type-check
- next build
→↓
03
Security
- CodeQL SAST
- gitleaks
- npm audit
→↓
04
Quality
- Lighthouse budgets
- Link check
- Header check
→↓
05
Deploy
- Vercel
- Preview per PR
→↓
06
Observe
- Live /status
- Dependabot

Security plane

CSP · HSTS preload · COOP / CORP · security.txt · no trackers

Every push to this repository runs the same stages. A failing gate blocks the deploy.

Security headers

The exact headers every response carries, read from the same file the server uses.

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self'; connect-src 'self' https://vitals.vercel-insights.com; frame-src 'none'; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; manifest-src 'self'; report-to csp-endpoint; report-uri /api/csp-report
Reporting-Endpoints: csp-endpoint="/api/csp-report"
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=(), browsing-topics=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin

Performance budgets

Lighthouse runs in CI on key pages. Scoring below these minimums fails the build.

≥ 90
performance
≥ 95
accessibility
≥ 95
best practices
≥ 95
seo

Stack

Framework: Next.js 16 (App Router), React 19, static rendering by default
Language: TypeScript 7, strict mode
Styling: Tailwind CSS 4, design tokens as CSS variables, light and dark
Content: MDX articles; all identity data in one typed source file
Hosting: Vercel, a preview deployment for every pull request
Dependencies: Next, React, MDX. No UI kits, no analytics trackers, no client-side data fetching

Machine-readable

llms.txtprofile summary for LLM tools
sitemap.xmlindexable pages only
robots.txtsearch and AI crawlers allowed
feed.xmlRSS for articles
security.txtRFC 9116 disclosure contact

deployed ddd175f from master

Live system status →

Security headers

The exact headers every response carries, read from the same file the server uses.

Content-Security-Policy

default-src 'self'; script-src 'self' 'unsafe-inline' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self'; connect-src 'self' https://vitals.vercel-insights.com; frame-src 'none'; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; manifest-src 'self'; report-to csp-endpoint; report-uri /api/csp-report

Reporting-Endpoints

csp-endpoint="/api/csp-report"

Strict-Transport-Security

max-age=63072000; includeSubDomains; preload

X-Content-Type-Options

nosniff

X-Frame-Options

DENY

Referrer-Policy

strict-origin-when-cross-origin

Permissions-Policy

camera=(), microphone=(), geolocation=(), browsing-topics=()

Cross-Origin-Opener-Policy

same-origin

Cross-Origin-Resource-Policy

same-origin

Stack

Framework

Next.js 16 (App Router), React 19, static rendering by default

Language

TypeScript 7, strict mode

Styling

Tailwind CSS 4, design tokens as CSS variables, light and dark

Content

MDX articles; all identity data in one typed source file

Hosting

Vercel, a preview deployment for every pull request

Dependencies

Next, React, MDX. No UI kits, no analytics trackers, no client-side data fetching