A marketing site that grew a backend
Georgian Land Limited needed one document to reach a narrow audience and nobody else. The interesting part is that a gate which hides content in the browser is not a gate.
Client: Georgian Land Limited.
The site began as a brochure. Then it needed to put a substantive document in front of people who qualify to receive it, and nobody else. That is a different kind of site.
The naive version of this ships the document to every visitor and hides it behind a password prompt in the browser. Anyone who opens the network tab has the file. It looks like a gate and it is a filing cabinet with a picture of a lock on it.
What was built instead keeps the protected content out of the client bundle entirely. The visitor self-certifies, that certification is recorded, and an edge function serves the document against the record on every request. Nothing protected is ever sent to a browser that has not earned it.
The general rule, which applies well beyond regulated documents: if the secret reaches the client, it is not secret. Access control belongs on the server or it does not exist.