Online protected access
Gouvernance
An audit, turned into a decision space.
In short
An "audit-as-a-service" platform, currently used for the Liora Cyber Admin project (DATASC.SEA IS-governance audit).
It merges two normally-separate deliverables: an IS-governance consulting dossier (audit, FMEA risk analysis, 4 costed target architectures) and a "command center" web app that makes it browsable, source-faithful and secure. Static Astro site on Cloudflare, ⌘K Pagefind search, Mermaid diagrams, server-side PIN lock. Zero external runtime dependency.
Highlights
-
Risk explorer
Sort / filter / search by severity & domain across the 64 FMEA rows (55 scored vulnerabilities, Risk /10 = Impact /5 + Probability /5)
-
Global architecture selector
Switches the whole site (architecture, sizing, budget) onto one of 4 costed targets (retained hybrid, full on-prem, full cloud, budget Proxmox): CAPEX / OPEX / 5-year TCO
-
37 briefs + dual reading
Numbered knowledge base loaded from the Markdown source, Study / Clean toggle that hides or reveals the teaching notes
-
Command palette · static search
100% static full-text search indexed at build (Pagefind), no search backend, grouped side-nav + mobile drawer
-
Server-side PIN lock
No content page is served without a valid cookie: HMAC-SHA256 signed cookie (HttpOnly, 30-day expiry), constant-time comparison, anti-brute-force 10 fails / 15 min per IP in KV
-
Full report + deliverables
Web report faithful to the PDF source + viewer for the 5 PDF deliverables (~5.6 MB), CSV / TSV exports of the risk table
-
Mermaid mapping
Target architecture + Gantt rendered client-side on demand (lazy), only on the mapping pages
-
Build-parsed dashboard
CIA counters, top-10 risks and per-domain distribution computed at build from the FMEA TSV, no application database
By the numbers
- 117K Words of analysis
- 64 FMEA risks
- 4 Target architectures
- 37 Markdown briefs
- 19,865 Lines (app)
- 5 PDF deliverables
The story
Why I built it
The Liora Cyber Admin project required a full IS-governance audit: risk analysis, target architecture, continuity plan. A classic consulting dossier stays a PDF nobody opens. I turned it into a product: gouvernance.mindvisionstudio.com is an "audit-as-a-service" platform that takes the DATASC.SEA dossier (117,000 words of analysis, 64 scored FMEA risks, 4 costed target architectures) and makes it browsable, interactive and secure, on desktop and mobile.
Static Astro site served from the Cloudflare edge, ⌘K full-text search indexed at build, on-demand Mermaid diagrams, and a server-side PIN lock that guarantees the dossier’s confidentiality. The template is reusable: one audit, one dedicated space.
Structural technical decisions
Deliver an audit as a product
The project merges two normally-separate deliverables: the IS-governance consulting dossier (audit, FMEA, target architecture) and a "command center" web app that brings it to life. The value remains the analysis work (~55%); the software layer (~45%) turns it into an interactive steering tool, reusable for the thesis defense and for a real client alike.
Global architecture selector, 4 costed scenarios
A single selector switches the entire site (mapping, sizing, budget) onto one of 4 target approaches, each hardened "against the jury" with CAPEX, OPEX and 5-year TCO (from €372k to €813k). The audit and risks are common to all 4; only the architecture varies: the sovereign hybrid is retained (~€417k 5-year TCO, 15% below the reference).
Server lock, zero external runtime dependency
No content page is served without a valid cookie (Cloudflare Worker). HMAC-SHA256 signed cookie via Web Crypto (HttpOnly, 30-day expiry, auto-login), constant-time PIN comparison (timingSafeEqual, no timing leak), anti-brute-force 10 fails / 15 min per IP in KV, secrets out of code. Self-hosted fonts, search and data computed at build: nothing to fetch in production.
Custom content pipeline (7 plugins)
The Markdown content (37 briefs + report) runs through 7 custom remark/rehype plugins: Obsidian wikilinks → internal links, callouts → teaching notes driven by the Study/Clean toggle, coloring of risk IDs / IPs / scores, tables → cards on mobile. The FMEA dashboard is parsed at build from a TSV, no application database.
The non-trivial challenge
Guaranteeing the dossier’s confidentiality with no database and no runtime dependency
A governance-audit dossier contains network plans, IPs, exploitable vulnerabilities: it must never leak. The challenge: lock down a fully static site with no application backend. Answer: a Cloudflare Worker intercepts every request and refuses any content page without a valid cookie.
The PIN is compared in constant time, the cookie is HMAC-SHA256 signed (Web Crypto), and a KV counter blocks the IP after 10 fails in 15 min. Everything else is resolved at build (Pagefind search, FMEA dashboard, self-hosted fonts), zero third-party service called at runtime, minimal attack surface.
Lesson learned
A consulting deliverable becomes ten times more valuable the moment it turns into a browsable, secured product. Static + edge doesn’t forbid confidentiality: a well-built server lock (HMAC cookie, timing-safe PIN, KV anti-brute-force) protects a 100% pre-rendered site without sacrificing speed or cost.
And the "audit-as-a-site" template is reusable. A dedicated space per engagement: the content changes, the engineering stays.
Tech specs
Where it runs Astro 5.7 (static) · Cloudflare Pages · Worker (lock) · KV (anti-brute-force)
| Generation | Astro 5.7 (static) · View Transitions · TypeScript strict |
|---|---|
| Hosting | Cloudflare Pages · Worker (lock) · KV (anti-brute-force) |
| Search | Pagefind (static) · ⌘K palette |
| Content | 7 custom remark/rehype plugins · Markdown / wikilinks · Mermaid (lazy) |
| Fonts | @fontsource Inter · Space Grotesk · JetBrains Mono (self-hosted) |
| Security | Server PIN · HMAC-SHA256 cookie · timingSafeEqual · Cloudflare secrets |
