• Least privilege for admin and write paths.
• Public content is read-oriented; privileged actions require auth.
• Secrets stay in server environment variables, never in client bundles.
• User-submitted content is treated as untrusted input.

The dashboard is protected by Firebase Authentication and an allowlisted admin email check. Middleware and client guards block unauthenticated access to admin routes.

• Session indicator cookie is set only after a successful admin sign-in and is not used as the sole security boundary.
• Admin capabilities (content edits, asset sync) are not exposed to anonymous visitors.

Contact and project inquiry submissions are written to Firestore when Firebase is configured. Security depends on deployed Firestore rules and Admin SDK credentials kept off the client.

• Client apps use public Firebase config suitable for browser use; privileged Admin SDK keys are server-only.
• Publish and seed scripts require FIREBASE_ADMIN_* environment variables and must not be run in untrusted environments.

• Production traffic is served over HTTPS.
• Hosting and edge platforms provide TLS termination and standard DDoS / edge protections according to the provider.
• Environment secrets (API keys, service accounts) are stored in the host’s secret/env configuration, not in git.

• Chat requests go through a Site API route, not directly from the browser to every upstream key when server-mediated.
• The assistant is scoped to portfolio / contact guidance; it is not a privileged admin tool.
• Do not submit passwords, API keys, medical data, or other sensitive secrets into chat.
• Upstream model providers may process prompts to generate responses; see the Privacy Policy.

• Form submissions are validated on the client and treated as untrusted on write.
• Admin upload and sync endpoints check for an authenticated session before performing privileged work.
• Dependency updates and linting are part of normal maintenance; run npm audit / lockfile reviews before major deploys when possible.

• Use strong unique passwords for any admin account.
• Do not share admin credentials or service-account JSON.
• Report suspected abuse of contact forms or chat promptly.

If you find a security issue, please email sifatali008@gmail.com with:

• A clear description of the issue and impact
• Steps to reproduce (proof of concept without harm)
• Your contact details for follow-up

Please do not publicly disclose the issue until I have had a reasonable window to investigate and fix it. Please do not access other people’s data, disrupt the service, or run destructive tests.

No system is perfectly secure. This Site is a personal portfolio and content platform. For regulated workloads (for example clinical PHI), do not upload sensitive datasets here; use a dedicated, contractually scoped environment instead.

Data handling details live in the Privacy Policy.