Case study · Marketing site
Leverage Nifty
Independence, documented.
A bilingual marketing site for an independent engineering consultancy in Mexico City — contract engineering, site supervision and electromechanical maintenance for infrastructure owners. Built to make an argument about independence, and engineered so the copy, the security posture and the enquiry flow all hold up under scrutiny.
Visit the live siteEngineering
- Next.js App Router · React 19
- CSS Modules · no inline styles
- Per-request CSP nonce · strict-dynamic
- Compiler-enforced ES/EN dictionary
- Server-revalidated enquiry endpoint
- Honeypot & per-IP rate limiting
The problem
An independent consultancy sells judgement, not equipment — and its whole value rests on having no second beneficiary. That is a hard thing to assert on a website without sounding like every supplier that also asserts it. The site had to demonstrate the position structurally rather than claim it in a headline.
What it does
It presents two divisions under one standard: consulting and supervision for the people deciding an investment — technical scopes, contract auditing, independent on-site supervision — and maintenance and spare parts for the people operating the asset, covering lifts, escalators and electromechanical systems. Case work is presented anonymised where confidentiality requires it, and the enquiry form routes to a real endpoint.
Spanish first, English in parity
The business operates in Spanish, so Spanish is authoritative and English is a full translation rather than a fallback. The English tree is type-checked against the Spanish one: a missing or misspelled key fails the build. Translation drift is a maintenance problem on most bilingual sites; here the compiler catches it before a visitor does.
Locked down by default
A Content-Security-Policy nonce is minted per request and scripts run under strict-dynamic, so an injected script has nothing to execute with. Inline styles are forbidden outright — every rule lives in a stylesheet. HSTS, frame denial, MIME-sniffing protection, a strict referrer policy and cross-origin isolation headers are set at the framework level, not bolted on.
An enquiry form that tells the truth
Every field is revalidated on the server and untrusted JSON is coerced before it is trusted, so a type-confusion payload cannot slip a boolean past a consent check. A honeypot field absorbs bots and submissions are rate-limited per IP. If the delivery endpoint is unavailable the form says so and offers the phone number — it never shows a success message for a message that went nowhere.
Status
Build complete and verified against a production build. The site is live at leveragenifty.com.