pphatdev/pphat.me

pphat.me is a substantial personal portfolio with far more depth than a basic profile site. The Next.js application presents projects, technical posts, a gallery, contact information, skills, and professional background through a polished responsive interface. Content lives in Markdown and MDX with reusable frontmatter models, recursive discovery, publication filtering, pagination, and cached loading. SEO work is especially thorough. The repository includes detailed metadata, structured data components, RSS, Atom, and JSON feeds, several sitemap generators, image sitemap support, canonical URLs, and social previews. Dynamic loading helps keep below-the-fold homepage sections out of the initial bundle, while dark-mode support, optimized images, long-lived static caching, security headers, a locked dependency tree, and ongoing Dependabot updates show attention to production concerns.

The biggest improvement is automated verification. There are scripts for SEO and structured-data checks, but no standard test command, component tests, end-to-end tests, or GitHub Actions workflows. This means dependency updates can be merged without visible proof that the site still builds or that posts, projects, feeds, contact forms, and metadata work correctly. CI should run installation with the lockfile, linting, type checking, the production build, SEO checks, and a few Playwright tests for navigation and contact submission.

The contact endpoint also needs stronger abuse controls. Its in-memory rate-limit map resets between serverless instances, grows without cleanup, and relies on the first x-forwarded-for value. A shared rate limiter and bot challenge would be more dependable. Contact fields are inserted directly into the HTML email without escaping, allowing submitted markup to affect the received message. Input should use a Zod schema with length limits and HTML escaping. The unrestricted HTTP and HTTPS host patterns in the Next.js image configuration should also be narrowed to known domains to prevent the image optimizer from becoming a general-purpose proxy. Documentation is currently outdated: it references a different repository, says Node 18 is sufficient, and recommends an undefined npm preview command. Repository metadata reports roughly 850 MB of content, with no Git LFS configuration, so moving large media out of Git would make cloning much faster. Adding a license would clarify reuse rights. Overall, this is a capable and carefully presented portfolio with strong content and SEO engineering. Better testing, security controls, documentation, and asset management would make the repository much easier to maintain and trust.