Security & Trust
A security portfolio should practice what it demonstrates. Here's how this site itself is built.
Secure architecture
- AI calls run server-side only, in Next.js Route Handlers -- no provider key ever reaches the browser.
- Bounded retrieval: Ask Amalachukwu answers only from this site's own structured evidence data -- no arbitrary web, filesystem, or tool access.
- Input validation and length limits on every endpoint.
- Request timeouts on every AI call.
- Controlled error handling -- responses never include internal error detail or stack traces.
Application security
- Security headers on every response: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
- Server-rendered architecture (Next.js App Router).
- External links use secure, non-tabnabbable handling.
- Secret management: nothing is committed to the repository; credentials are read from environment variables, server-side only.
Privacy by design
- Evidence-grounded AI: Ask Amalachukwu draws only from this site's own verified content.
- The Role Fit Analyzer doesn't store a pasted job description -- it's used in memory for one request and discarded.
- Minimal request metadata; no unnecessary tracking.
- The AI Governance Workbench runs entirely in your browser -- nothing you select is sent or stored.
Secure development
- TypeScript throughout, with linting and type checks on every change.
- Automated tests and a verified production build.
- Regular dependency review.
- A documented internal security review, maintained alongside the codebase.
Responsible disclosure
If you find a security issue on this site, please email onyenweamala@gmail.com with details.