Colophon

Next.js 16 · React 19 · TypeScript · Tailwind CSS 4

App Router, server components and single-URL bilingual i18n (Turkish canonical · English).

Cloudflare Workers · OpenNext

The site runs as a Worker on the global edge network — no classic server, no cold starts.

KV + D1 + Workers AI

KV: encrypted data + rate limiting + event stream. D1: SQL analytics mirror. Workers AI: the Llama chat on this site.

Email Routing + 3 Workers

The main site, a spam-filter worker that scores and drops inbound mail, and a cron/uptime worker. Outgoing mail is branded multipart MIME.

Edge

Custom WAF rules (browser/bot/datacenter shields), DNSSEC, CAA, HSTS preload, TLS 1.2+, MTA-STS enforce.

Form Protection

Every write endpoint runs the same stack: same-origin + Turnstile + honeypot + HMAC time-trap token + IP rate limiting.

End-to-End Encryption

The contact form is zero-knowledge with ECDH P-256 + AES-256-GCM; PII is never stored in the clear on the server.

Detection / Mini-SIEM

Honeypot endpoints, brute-force counters, request-flood events and new-device alerts all land in a single security stream; critical events e-mail the owner.

Admin

The panel sits behind Cloudflare Access (e-mail OTP), a separate key and a brute-force lockout; every sensitive action is written to a tamper-evident, hash-chained audit log.

push → deploy → smoke → cv.pdf

Every push: automatic deploy, then Playwright smoke tests against the live site, then the CV PDF is re-rendered and published if needed. No manual steps.

Dependabot · gitleaks · npm audit

Dependency updates, leaked-secret scanning and vulnerability auditing run continuously in CI.

27 Jul 2026

Every backend binding of the old interface completed on the new design: contact security layer + live widgets (visitors · Spotify · GitHub stars) + CV request flow

26 Jul 2026

Simplification: i18n reduced to TR · EN · AI chat upgraded to Llama 3.3 70B · CV PDF refreshed

26 Jul 2026

/now · /uses · guestbook · light theme · offline support · uptime monitoring

26 Jul 2026

NIST CSF 2.0 security governance pack + 7-dimension audit (92/100) + full CI automation

23 Jul 2026

SEO + accessibility + performance sprint; canonical language Turkish

8 Jun 2026

Mini-SIEM: unified security event stream + brute-force detection + AI chat token gate + WAF expansion

7 Jun 2026

All 7 languages complete: TR · EN · AR · ZH · ES · FR · DE

6 Jun 2026

Inbound e-mail spam filter: a scoring worker in front of Email Routing

5 Jun 2026

Attacker-model security audit: every finding closed + Access OTP + DNSSEC + CAA

3 Jun 2026

End-to-end encrypted contact: ECDH P-256 + AES-256-GCM (zero-knowledge)

2 Jun 2026

Edge hardening: custom WAF rules + TLS-RPT + MTA-STS + admin dashboard v2

1 Jun 2026

Multi-layer hardening of the contact pipeline + PII encryption + interactive terminal v2 + live widgets

26 May 2026

msgxr.dev is live: domain + first deploy