matthieuguiot.dev

A portfolio that only displayed hardcoded text would have proved nothing. This one has a full backoffice: projects, posts, services, career history, media library, contact messages, and the headings and paragraphs of the public pages themselves, all editable in French and English from the same place.

The content

Site copy lives in the database in two shapes: a string for short labels, a structured document for paragraphs, written in a rich editor deliberately limited to bold, italic, links, lists and two heading levels. The server revalidates that document against an allowlist of nodes before storing it, so the rendered page can only contain what the editor permits.

No demo data anywhere. When a section has not been filled in, the site says so instead of inventing filler.

Security

Passwords hashed with Argon2, a short-lived access token kept in memory, a refresh token in an httpOnly cookie that rotates on every use and revokes its whole lineage if it is replayed. The contact form is rate limited and trapped against bots. Uploaded files are checked on their actual content, not on what the browser claims. Every page ships a content security policy with a per-request nonce.

Performance

Public pages are server-rendered and cached; saving in the backoffice invalidates that cache immediately, with no restart and no waiting. The particle field on the home page runs in WebGL and pauses as soon as it leaves the screen or the tab goes to the background.