I built a private inbox into my portfolio

My portfolio's contact form used to drop messages into Gmail. I wanted more: to see who asked for what, reply from my own domain, and keep my phone number off the internet. So I turned the site into a small private inbox.

What it does

Public resume, private CV. Visitors request my full CV. I approve each request, and they get a private link that expires after seven days.
I reply from my own admin, from my own domain, with ten seconds to undo.
Replies land back in the same thread, with a push notification on my phone.

How it works

Emails go out through Brevo. Replies to my addresses go to a small Cloudflare Email Worker, which forwards them to my inbox as usual and sends a copy to my site. The site matches each reply to its conversation using the Message-ID of the email I sent.

What broke

A "Bad Gateway" that wasn't. The real error was a rejected SMTP login, but my API returned 502, and Cloudflare replaces 502 errors with its own page. Lesson: never use 502 for your own errors behind Cloudflare.

Forged senders. Matching replies by the From address was unsafe, because it is easy to fake. Now a reply only joins a thread if it quotes my Message-ID or passes Cloudflare's SPF, DKIM and DMARC checks.

Privacy

Old conversations delete themselves after 12 months, and CV links are stored only as hashes, so even a leaked database has no working links.

If you're a recruiter: the CV request button really does reach me.

What it does

Public resume, private CV. Visitors request my full CV. I approve each request, and they get a private link that expires after seven days.
I reply from my own admin, from my own domain, with ten seconds to undo.
Replies land back in the same thread, with a push notification on my phone.

How it works

What broke

Privacy

Old conversations delete themselves after 12 months, and CV links are stored only as hashes, so even a leaked database has no working links.

If you're a recruiter: the CV request button really does reach me.