Skip to content

Security: Surfrrosa/portfolio

Security

Report a vulnerability

docs/SECURITY.md

Security Checklist

Environment Variables

  • .env.local is gitignored (listed in .gitignore)
  • .env.example contains placeholder values only, no real secrets
  • Secrets (RESEND_API_KEY) accessed via process.env server-side only
  • No secrets exposed to client-side bundles
  • Production env vars stored in Vercel dashboard, not in repo

API Route Security

/api/contact (POST)

  • Input validation: checks for required fields (name, email, message)
  • Returns generic error messages (no stack traces or internal details)
  • Uses replyTo instead of injecting user email into from field
  • Server-side only: Resend SDK and API key never reach the client
  • Rate limiting: not implemented (Vercel provides basic DDoS protection)
  • CSRF protection: not implemented (acceptable for public contact forms)

Input Handling

  • Contact form uses controlled React inputs (no dangerouslySetInnerHTML on user input)
  • Blog content is author-controlled MDX, not user-submitted
  • StructuredData uses JSON.stringify for safe JSON-LD injection
  • No SQL databases (no SQL injection surface)
  • No URL parameter parsing for dynamic queries

Dependencies

  • All dependencies pinned to exact versions (no caret ^ or tilde ~)
  • No known malicious packages
  • Unused packages removed to reduce attack surface
  • sharp included as devDependency for image optimization (build-time only)

CORS and Headers

  • Next.js default CORS behavior (same-origin for API routes)
  • No custom CORS headers configured (API is same-origin only)
  • Vercel adds security headers by default (X-Frame-Options, etc.)

Authentication

  • No authentication required (public portfolio site)
  • No user accounts or sessions
  • No admin panel

Deployment

  • Vercel auto-deploys from main branch only
  • HTTPS enforced by Vercel
  • No SSH keys, deploy tokens, or credentials in repo
  • Build logs do not expose secrets (env vars are masked)

Content Security

  • External scripts limited to Google Analytics (loaded via next/script)
  • Vercel Analytics loaded as first-party
  • No inline scripts except GA config (CSP-compatible via next/script)
  • Images served from same origin or specified domains
  • Video/audio assets served from same origin

Monitoring

  • Google Analytics for traffic monitoring
  • Vercel Analytics for performance and web vitals
  • Vercel deployment logs for build and runtime errors

There aren’t any published security advisories