Public by intent
The professional profile, selected links, and this explanation are committed as typed local content and served statically. They keep working even when the private backend is unavailable.
About this page
Public when useful.
Private by default.
This profile is also a practical demonstration of privacy-conscious web architecture: the public identity layer is fast and resilient, while sensitive information needs an explicit capability.
Contact by proximity
Phone and email are not embedded in the public page. A compatible secure NFC tap creates a short-lived contact capability after server verification.
CV by invitation
Random application codes can grant narrowly defined CV permissions. Codes can expire, be revoked, and are stored only as keyed digests—not as readable secrets.
Architecture
Three paths, one clear boundary
Public visitorNo credential
Secure NFCDynamic message
Access codePOST exchange
Vercel + Next.jsStatic page / verifier
Scoped sessionHttpOnly cookie
Public profileLocal content
SupabasePrivate data + RLS
Contact / CVScope checked
NFC, without a static secret
The production target is an NXP NTAG 424 DNA using Secure Dynamic Messaging. Each tap can produce authenticated dynamic data. The server validates it, checks the read counter against replay, and issues only a temporary contact grant. NFC does not grant CV access.
Capabilities, not accounts
A visitor does not create an account. A high-entropy application code is exchanged once for an opaque browser session. Each grant names exactly what it permits, such as reading the CV or downloading its PDF.
Minimal observation
There are no advertising trackers by default. Security events contain minimal identifiers, raw credentials are never logged, and short-lived rate-limit records store a keyed pseudonymous value instead of a plaintext IP address.
Layered, not “unhackable”
Next.js, GitHub, Vercel, Supabase, and the secure tag each sit in a defined trust boundary. Cryptography, server-side authorization, revocation, RLS, caching controls, and careful defaults reduce risk; they do not make absolute security claims.