Security and operations
Measures that actually run - verifiable in the code, not in a certification statement nobody earned.
Bot protection on forms
The contact form combines a honeypot field, a timing trap (a submission faster than a person could react is suspicious) and, optionally, an invisible Cloudflare Turnstile. A bot gets a silent success, not a signal that it was detected.
Input validation
Every form input goes through typed validation (Zod) on the server, not just in the browser - bypassing client-side JavaScript does not bypass the check.
Secrets outside the repository
API keys and signing secrets (Resend, Turnstile) live in environment variables, never in git. Without them, the form in dev mode just logs the lead and does not crash.
Versioned deployment
Deployment runs through Vercel connected to git - every change is versioned, traceable and can be rolled back to the previous state.
HTTPS and no extra third-party trackers
Websites run exclusively over HTTPS. The only analytics is Vercel Analytics - no Google Tag Manager full of third-party scripts that cannot be checked in advance.