Under the Hood
This page records what is implemented in the repository, what has been tested locally, and what still requires a dated external or provider result. It does not turn targets or provisional observations into verified claims.
Verification Status
| Area | Status | Evidence boundary |
|---|---|---|
| Browser security headers | Implemented and tested locally | Application-owned CSP and hardening headers are defined in src/lib/buildSecurityHeaders.ts and emitted by next.config.ts. The application does not emit HSTS. |
| Vercel edge and Cloudflare DNS authority | External verification pending | Provider settings, direct-origin behavior, edge behavior, and duplicate-header checks require dashboard inventory and dated captures. |
| Automated accessibility | Tested locally | Jest and jest-axe tests cover the main pages and key sections. This is not a substitute for a manual WCAG 2.1 AA audit. |
| Lighthouse and PageSpeed | External result pending | No production or local production-build performance score is claimed until a dated run is recorded. |
| W3C Nu Validator | External result pending | No HTML validation error count is claimed until the built page has been checked and the result is recorded. |
| TLS and certificate verification | External result pending | Vercel settings (TLS, HSTS, edge caching, WAF) and Cloudflare DNS settings and a dated Qualys SSL Labs result remain owner-run evidence. |
| Technology stack | Implemented and documented | Framer Motion, GSAP, Three.js, React Three Fiber, and Drei are not part of the current portfolio stack. The protected credits carousel remains a CSS implementation. |
| CI quality gates | Implemented; provider settings pending | .github/workflows/ci.yml runs install, lint, type-check, dead-code, test, and build checks. GitHub Actions, Dependabot, and branch protection still require owner inventory. |
Provider Authority
Vercel owns transport, edge caching, and WAF behavior; Cloudflare owns DNS; GitHub owns repository automation and branch protection, and this Next.js application owns its browser-hardening headers. The provider inventory and rollback record remain in the authority matrix until Marcio Merlone supplies dated evidence.
Open the provider authority matrix