Security Architecture & Trust
Security Architecture Overview
An overview of the defensive security architecture, authentication standards, transport protections, and responsible disclosure policies governing the Gaurav Portfolio platform.
Security Architecture Philosophy
The security posture of Gaurav Portfolio and its verified subdomains (gauravpatil.site, self.gauravpatil.site, contact.gauravpatil.site, resume.gauravpatil.site, talk.gauravpatil.site, admin.gauravpatil.site) is rooted in the principle of defense-in-depth and minimal attack surface. Rather than relying on monolithic perimeter controls, every subsystem—from visitor contact routing and verified candidate resume presentation to administrative consoles—is compartmentalized with explicit boundary validation.
Administrative Access & Authentication
Access to the portfolio administrative subsystem is restricted to Gaurav Patil through a multi-layered verification pipeline:
OAuth 2.0 PKCE Whitelist
Identity tokens are exchanged using standard PKCE flows and verified strictly against the pre-configured Superadmin whitelist.
Multi-Factor Passcode Verification
Secondary challenge delivery via secure transactional channels with strict time-to-live and attempt limitations.
Session Lifecycle Scoping
Encrypted, `HttpOnly`, `SameSite=Strict` session cookies with deterministic expiration and automated session detachment.
Device & Telemetry Validation
Automated security alerts dispatched on unrecognized sign-in parameters to prevent unauthorized session hijacking.
Edge Protection & Bot Defense
Public endpoints and access gates—including the contact modal, recruiter portal, and interactive resume access on resume.gauravpatil.site—are protected against automated abuse, denial-of-service, and credential enumeration through Cloudflare Turnstile. Unlocked candidate resume sessions enforce a strict 30-minute inactivity TTL with HMAC-signed session destruction.
Turnstile validates human traffic using non-interactive browser challenges without tracking cookies or cross-site user profiling. Submissions that fail validation are dropped at the API boundary before reaching backend mail dispatchers or persistence layers.
Data Access Layer Separation
Database interactions operate under a strict 4-Tier pipeline (`UI → Repository → DataSource → Cloud Database`). Frontend components never import database SDKs or interact with storage layers directly.
Inquiries and subscriber records are isolated in secured cloud collections with atomic mutation boundaries, preventing data contamination and orphaned state.
Transactional Email Gateway Standards
All transactional correspondence dispatched from the platform originates from authenticated domains (gauravpatil.site) via encrypted Brevo REST APIs.
Domain records enforce strict SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC alignment to prevent email spoofing, phishing, and impersonation attacks.
Responsible Vulnerability Disclosure
If you discover a security vulnerability, configuration flaw, or potential exploit in this portfolio or associated subdomains (gauravpatil.site, self.gauravpatil.site, contact.gauravpatil.site, resume.gauravpatil.site, talk.gauravpatil.site, admin.gauravpatil.site), you are encouraged to report it responsibly.
Please provide detailed steps to reproduce the issue, along with any relevant proof-of-concept material. Reports are reviewed directly and remediated promptly.