Nexus Archive

01 / Overview

Problem

Media trackers split entertainment libraries across platforms and can have weak security controls. Nexus Archive brings titles, ratings, notes, and recommendations into one account with row-level access controls.

Solution Overview

1. Built a full-stack vault with React 19 + Litestar API backed by Supabase PostgreSQL with Row Level Security
2. Implemented backend-managed HttpOnly auth cookies replacing frontend-readable Supabase tokens
3. Integrated Gemini AI for media recommendations with shared per-user rate limiting and local fallback
4. Added encrypted takeaway persistence and AI prompt isolation with PII masking

02 / Evidence

Proof & Verification

• Hardened auth: HttpOnly + SameSite=Strict cookies with silent token rotation
• CI security gates: Bandit, pip-audit, npm audit, secret scanning
• Locust load testing for performance verification
• Terraform IaC scaffold for reproducible Supabase + Vercel deployments

03 / Methods

Build

Tech Stack

• React 19
• Vite
• Tailwind CSS 4
• TanStack Query
• Python 3.12
• Litestar
• Supabase PostgreSQL
• Docker
• Terraform

• AI-assisted media recommendations via Gemini with graceful degradation
• Real-time chat transcripts with user-scoped sanitisation
• Status tracking, ratings, and reviews for anime, movies, and books
• Smart filtering and search across entire media library

Secure

• HttpOnly SameSite=Strict auth cookies (no frontend-readable tokens)
• Short-lived access tokens with silent rotation via /auth/refresh
• AI prompt isolation with XML delimiters, string scrubbing, and PII masking
• Encrypted takeaway persistence (AES via TAKEAWAY_ENCRYPTION_KEY)
• Bandit, pip-audit, npm audit, and secret scanning in CI