Dev log #3 or #4??

After the site went multi-distributor, I kept going.

I added a contact page with my email, Instagram and GitHub, dropped GitHub out of the header, gave the footer real columns with links that work, moved the data source note over to the About page and wrote more there. The front page got more to read too, and the About cards now sit in a clean 2x2 grid.

Then I did a proper security pass. I added a middleware that stamps security headers on every API response, including CSP, frame options and HSTS. Wrote a rate limiter that reads the client IP from headers the platform actually writes, never the one a caller can fake, and capped its key table so the limiter itself cannot be turned into the attack. Added input caps: query at 200 characters, page at 50, part key at 128, all refused early so nobody can burn my distributor quota. Added a body size ceiling and tightened CORS.

The static site got its own CSP through vercel.json, checked against the real built bundle.

I also wrote guard tests: they fail if a stray .env gets committed, if a credential literal shows up in source, if SQL starts joining values instead of using placeholders, or if a Set-Cookie ever appears. Then I documented the whole posture in the backend README, including what I deliberately left out and why.