You can be the most intellectual person on the planet but if you have a child-like mindset, that is, being very emotional and prioritizing it over your logical reasons & expressing them through your actions, then people aren't going to respect you for the type of person you are.
17. Booking/inquiry flow components for services
18. Toast/notification system for forms, tools, newsletter
19. Photography portfolio filtering & tagging by type/subject/year
20. Print/share styles for tools and blog (@ media print)
21. Re-audit security, Convex input validation, NextJS architecture CI/CD Hardening
Progress to completion: ~80-83%, more or less
Trying to create and finish my boilerplate before the end of this month as my goal!
#webdev#indiedev
#BuildInPublic β Days 85-92: Creating a creator-CMS portfolio boilerplate based on my NextJS website I'm currently working on.
I wanted to post on day 89 so this thread wouldn't get long. But there's something addicting about wanting to continue building instead of posting.
Now currently working on a cookie consent banner that's compliant with privacy laws like CCPA and GDPR.
My to-do list:
1. Security headers, env split, server-only, API rate limiting, strip console.log (β )
2. Convex input validation for all Server Actions & API routes (β )
Resend Fix
β’ Double-checked the code and realized Resend wasnβt properly wired. Contact submissions were saved to Convex but never emailed me.
β’ Added the proper Convex Action (fire-and-forget after DB insert, escaping, reply-to, etc.). Now inquiries actually reach my inbox.
PostHog Boilerplate Docs
β’ Fixed PostHog proxying so events survive aggressive ad blockers (uBlock Origin).
β’ Wrote clear setup guides for Convex, Upstash rate limiting, Cloudflare Turnstile, Resend, and PostHog.
Purpose is to make my boilerplate beginner friendly.
β’ Created a secured Convex error forwarding endpoint so background job failures are captured.
Error tracking performance (Core Web Vitals) is now solid end-to-end.
Sentry Observability (Second Pass)
Did a full sanity re-check and uncovered inconsistencies:
β’ Normalized environment, release, and tracesSampleRate: 0.1 across client, server, and edge configs.
β’ Added proper header scrubbing (authorization, cookie, x-revalidate-secret).
β’ Hardened scripts/seedGalleries.mjs with a proper destructive-mode guard (--confirm-delete --url required).
β’ Fixed various small gaps (fetch-depth, env handling, etc.).
The pipeline is now deterministic, supply-chain hardened, and will catch issues early.
β’ Pinned everything: ubuntu-24.04, Node 22.x, and all GitHub Actions to exact commit SHAs (no more @ v4).
β’ Added CodeQL workflow for SAST scanning.
β’ Added Dependabot config for both npm and GitHub Actions updates.
CI/CD Hardening (Second Pass):
β’ Went deep on making the pipeline reliable and secure:
β’ Refined the full .github/workflows/ci.yml with separate jobs for lint, typecheck (tsc --noEmit), build, and audit.
Accessibility (Second Pass):
β’ Added :focus-visible rings consistently across more buttons, CTAs, and interactive elements.
β’ Improved keyboard navigation and form labels on remaining tools/services pages.
β’ Added proper alt text, form labels, and aria attributes
Fixed water intake calculators with fieldset legend aria-labels
β’ Added aria-label to the mindful eating timer range slider
β’ Configured tracesSampleRate and verified test events Core Web Vitals monitoring in the production dashboard
Accessibility
β’ Added consistent :focus-visible rings on buttons, CTAs, and interactive elements
β’ Improved keyboard navigation and focus styles across the site
β’ Confirmed clean npm audit with zero high/critical vulnerabilities
Observability (Sentry Core Web Vitals)
β’ Completed full Sentry integration (client server configs)
β’ Added source map uploads and tunnel routing (/monitoring) to bypass ad/tracker blockers
CI/CD Hardening
β’ Added a full GitHub Actions workflow (ci.yml) with jobs for lint, typecheck, build, and production audit
β’ Pinned Node.js to 22.x (Active LTS) in CI, .nvmrc package.json engines
β’ Added stricter TypeScript flags and rules
Provider Refactor
β’ Refactored auth and Convex providers to fix root layout cookie read issues and hydration mismatches
β’ Improved separation of concerns and server/client boundaries
β’ Result: much more stable admin dashboard behavior