TomSec Portfolio & Secure Draft Pipeline
The portfolio doubles as a study in trust boundaries: public content is easy to explore, while a signed submission can only enter a private draft queue. Publishing remains an explicit editorial action.
02 / Problem
Problem
Accepting an automated draft must not grant a sender the ability to publish, execute commands or write to the website repository. Private or future content must not leak through search, RSS or the sitemap.
03 / Objectives
Objectives
Authenticate the exact submitted content, reject replay and invalid payloads, store drafts privately and require human review before a public build can include an article.
04 / ARCHITECTURE
Follow the components.
- Signed submission
- Validation boundary
- Private D1 queue
- Human review
- Public build
05 / Implementation
Implementation
Next.js, React and TypeScript run on Cloudflare Workers through OpenNext. HMAC covers the timestamp, nonce and request body. Zod constrains the payload, and D1 persists accepted nonces and private drafts. The approval script requires an explicit reviewed flag and refuses overwrites. Build preparation includes only reviewed, published articles whose date has arrived.
06 / SECURITY
Security boundaries
- Draft submission cannot publish or execute shell commands.
- Replay protection persists across requests.
- No infrastructure secrets or private health endpoints are supplied to the public application.
07 / Testing
Testing
The existing security verification covers unsigned and bad signatures, stale timestamps, replayed nonces, invalid slugs and attempts to submit published content. It also checks that drafts stay outside public routes and indexes. The interface is reviewed across desktop, tablet and phone sizes, with keyboard and reduced-motion checks.
08 / Challenges
Challenges
Build-time environment handling can accidentally embed local secrets in a deployment artifact. The build therefore removes sensitive environment values and checks the generated environment module. Browser CSP and safe content bundling must work together with the framework runtime.
09 / Lessons
Lessons
Authentication does not imply publishing authority. Keeping acceptance, editorial review and deployment separate makes each decision testable. Interface interactions follow the same principle: each one should explain content or help a visitor reach it.