Ibnu Portfolio v3

Production-grade Next.js 15 portfolio and super-app featuring AI tools, investment dashboards, and a secure admin panel. Live at heyibnu.com.

Privacy / SEO Policy

This site is intentionally private and link-only. Do not add SEO improvements, indexing metadata, structured data, sitemap entries, public discovery pages, or search-engine optimization work.

Dilarang memasang SEO. The intended audience is only people who receive the direct link, including selected employers and recruiters. Keep robots rules set to noindex/nofollow, keep crawler access blocked, and keep the generated sitemap empty unless the owner explicitly reverses this policy.

Highlights

• AI tools and agent playground
• Investment dashboards (crypto, stocks, gold)
• Extensive tools and mini-apps
• Admin vault at /vault
• Security hardening (rate limiting, CSP, audit logging)
• PWA + mobile app companion

Tech Stack

• Next.js 15, React 19, TypeScript
• Tailwind CSS
• Prisma + Postgres
• NextAuth v5
• Vercel/Cloudflare (recommended)

Quick Start

npm install
npm run dev

Environment

Minimum required:

• AUTH_SECRET (or legacy NEXTAUTH_SECRET)
• AUTH_URL (or legacy NEXTAUTH_URL)
• DATABASE_URL

Common optional:

• RESEND_API_KEY
• BLOB_READ_WRITE_TOKEN
• TENOR_API_KEY
• NEXT_PUBLIC_TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY
• NEXT_PUBLIC_BOOKING_URL, NEXT_PUBLIC_BOOKING_EMBED_URL

See DEPLOYMENT.md and docs/ for full configuration.

Useful Scripts

npm run dev
npm run build
npm run lint
npm run type-check
npm run test:e2e

Admin Setup

• Configure AUTH_SECRET and AUTH_URL.
• Create or update admin credentials from the local environment with ADMIN_EMAIL=<email> ADMIN_PASSWORD=<strong-password> npm run admin:create or ADMIN_EMAIL=<email> npm run admin:reset.
• Public/admin login is intentionally available only at /vault.
• Vault login intentionally uses admin email and password only. Do not expose Google/OAuth sign-in on this surface.
• After login, use /vault/admin as the private command center for sitemap control, content editing, monitoring, Supabase, and changelog access.
• Keep /vault/heyibnu-map-x9k2m7q4v1, /vault/changelog, /vault/x7p3q, /x7ctrl/*, and /admin/* admin-only. Do not add these links to public navigation, /, /hire, sitemap XML, or SEO surfaces.
• Legacy auth/setup pages such as /login, /register, /x7ctrl/login, and /x7ctrl/setup should remain hidden from public traffic.
• No default admin credentials are shipped.
• Admin scripts intentionally support the full portfolio Prisma user schema, the minimal production Neon users.email / users.password / users.role schema, and the legacy Supabase users.password_hash / users.is_admin schema.
• Do not store admin passwords, reset output, Supabase service-role keys, API tokens, or generated credentials in repo files or changelog entries.

Browser Security Notes

• Production builds strip console.* calls and do not emit browser source maps.
• Middleware returns 404 for .map asset requests, including /_next/static source-map probes.
• Keep secrets server-only. Only intentionally public browser keys may use the NEXT_PUBLIC_ prefix.
• Google/OAuth login env vars are intentionally not part of the active auth surface.

Changelog

• Maintain the repo-attached changelog in CHANGELOG.md.
• The private page /vault/changelog renders CHANGELOG.md for admin review.
• Every meaningful private route, admin, security, deployment, or content-management change should be recorded in CHANGELOG.md before pushing.
• Keep changelog access protected by vault admin login because it may describe private implementation details, back-office routes, and operational controls.

Deployment

Vercel is recommended. See DEPLOYMENT.md for the full checklist.