Why it's built this way.

Context

The site is mostly content that changes on deploy, not per request. Server-rendering every page adds latency, cost, and runtime attack surface for no benefit.

Decision

Use Next.js static rendering for all content pages. Only /status renders per request (its whole point is live checks) and /api/contact runs as a function. External data (Medium, DEV, GitHub) is revalidated hourly.

Context

Statically rendered Next.js pages inline their RSC payload as scripts. A strict nonce-based CSP requires a fresh nonce per request, which forces every page to render dynamically.

Decision

Ship a strict CSP everywhere else (default-src 'self', frame-ancestors 'none', object-src 'none', base-uri 'self', form-action 'self') but allow 'unsafe-inline' for scripts. 'unsafe-eval' is allowed only in local development.

Context

Career facts appear in page copy, meta tags, JSON-LD, llms.txt, RSS, and the resume. Copies drift, and drifting numbers destroy credibility with recruiters and confuse search engines and AI systems.

Decision

All identity data (roles, dates, impact numbers, certifications, projects) lives in one typed file, lib/data.ts. Every page and machine-readable output is generated from it.

Context

A DevSecOps portfolio should be verifiable, not just descriptive. Vercel builds from source, so CI can't attest the deployed artifact directly.

Decision

Generate a CycloneDX SBOM deterministically from the lockfile (no timestamps, sorted, serial derived from the lockfile hash). CI signs a SLSA build provenance attestation for it with Sigstore; the site serves the byte-identical file at /sbom.json.

Context

A plain email address on every page is harvested by spam crawlers within days.

Decision

Contact goes through the form and Calendly. The destination address exists only as a server-side environment variable, never in the (public) code; security.txt points researchers to the contact form, which RFC 9116 permits.

Context

Traffic and Core Web Vitals data are useful; tracking visitors across sites is not acceptable.

Decision

Use Vercel Web Analytics and Speed Insights (cookieless, no personal identifiers). No third-party trackers, ad pixels, or fingerprinting.

Context

Two earlier employers are listed as available on request. Blurring text with CSS still ships the name in HTML, JavaScript bundles, and search indexes.

Decision

Store only a generic description for confidential roles. The blurred placeholder is drawn with CSS so no fake or real name exists in the DOM.

Context

CI has write access to attestations and runs third-party code (actions and npm packages) on every push. Mutable action tags and unverified packages are how recent supply-chain compromises spread.

Decision

Pin GitHub Actions to major-version tags from trusted publishers (Dependabot keeps them current, after a 7-day cooldown for new releases), audit CI network egress with harden-runner, verify npm registry signatures and provenance on every build, scope workflow token permissions per job, lint every workflow with zizmor, require CODEOWNERS review, and scan the deployed SBOM for new vulnerabilities daily.