How this site is built

This site is the studio's first case study, so here's how it's made, and why.

Plain pages first

Every page is real HTML with all of its words in it, built ahead of time with Next.js as a static export. Search engines, AI answer engines, screen readers and anyone with JavaScript turned off get the whole site. Nothing runs on a server to show a page.

Strict security, checked on every build

Every page carries its own Content Security Policy, which lists the exact scripts it may run by their fingerprint and allows nothing inline. The build fails if anything slips in that the policy would block, and fails on any link to a page that doesn't exist.

Built, checked and previewed on every change

The infrastructure is written as code with Terraform, in a Google Cloud project of the site's own. Every proposed change is checked in Cloud Build, for accessibility, speed and security headers among other things, and deployed to a preview of its own before it's merged.

Built to move

Each Google service sits behind a thin layer so it can be swapped. The pages are plain files, and their security headers are written for any web server as well as for Firebase Hosting, so moving host is a DNS change.

The tools, and the API behind them

The forms and the free tools send what you give them to a small API at bezacore.com/api/, written in Python with FastAPI and run on Cloud Run. Its Postgres database has no public address. A form is saved before any mail goes out, so a send that fails is tried again rather than lost, and Cloudflare Turnstile stands between every form and anyone automating it.

The site health check fetches the address you give it from a service of its own that has no permissions at all, so a page it visits can't reach anything of ours. The AI readiness check never leaves your browser.

Keeping only what's in use

Everything the site stores has a date it's deleted, and the code that deletes it is checked like the rest. A sign-up nobody confirms goes after seven days, a health check report after thirty, and the addresses that limit how often a form can be used within a day. The privacy page lists the rest.

Watching it run

Page views are counted by analytics we run ourselves, with no cookies. Every five minutes, uptime checks try the site and the forms and email us when either stops answering, and the status page shows what they found over the last 30 days.