# FiL Hub — Complete Portfolio Reference

> Developer portfolio for FiL Hash — a touring music production manager turned software developer, building tools that solve real workflow problems for audio professionals, production managers, and touring artists. Based in Nashville, TN.

---

## Site Overview

- **URL:** https://fil-hub.vercel.app
- **Author:** FiL Hash
- **Contact:** filhashmore@protonmail.com
- **GitHub:** https://github.com/filhashmore
- **X/Twitter:** https://x.com/FiLHashDev
- **Location:** Nashville, Tennessee
- **Type:** Developer portfolio and project showcase
- **Stack:** React 18, Vite 5, TypeScript, Tailwind CSS, Framer Motion
- **Hosting:** Vercel (with security headers: CSP, HSTS, XSS protection, X-Frame-Options)
- **PWA:** Yes — installable as a progressive web app
- **Theme:** Dark theme (#0a0a0a background, neutral grays, gradient accents)

## Navigation

| Page | URL | Description |
|------|-----|-------------|
| Home | / | Hero, featured projects, about section, contact |
| Projects | /projects | Full project grid with category filter (All, Audio Tools, SaaS, Other) |
| About | /#about | Bio and skills grid (anchor on Home page) |
| Contact | /#contact | Email and social links (anchor on Home page) |

---

## About FiL Hash

FiL Hash brings 15 years of touring music industry experience to software development — spanning FOH & monitor engineering, production management, stage management, and playback. With a parallel career in photography, visual design, and branding for performing artists, FiL builds web and mobile tools that solve real production workflow problems — from RF coordination to setlist planning to venue advances.

Currently serves as Production Manager for touring country artist FILMORE.

### Core Skills

- Full-stack web & mobile development
- React, React Native, TypeScript
- Audio/RF engineering expertise
- Touring production workflow optimization
- Visual design & artist branding
- Supabase & serverless backends

### Domain Expertise

- Production advance workflows (venue tech requirements, hospitality, logistics)
- Tech riders, input lists, stage plots, hospitality riders
- RF coordination and frequency management (UHF, IEM, wireless mics)
- Audio engineering (FOH, monitors, IEM systems, wireless systems)
- Changeover protocols and load-in logistics
- Gear inventory and fly pack management
- Setlist planning, BPM/key analysis, show flow

### Tech Stack Preferences

- **Frontend:** React 18 + Vite 5 + Tailwind CSS + shadcn/ui
- **Mobile:** React Native + Expo 53 + NativeWind
- **Backend:** Supabase (auth, DB, row-level security) or localStorage for user-local data
- **Deployment:** Vercel with security headers
- **Icons:** Lucide React
- **Animation:** Framer Motion
- **Design:** Dark theme, mobile-first, offline-first when possible

---

## Project Catalog

### Audio Tools

#### RF Scout
- **URL:** https://rf-scout.vercel.app
- **Status:** Beta
- **Version:** 1.1 | Last Updated: Apr 2026
- **Stack:** React, Vite, Tailwind, Framer Motion, FCC API
- **Description:** RF frequency coordination tool for touring audio professionals. Provides real-time spectrum visualization with FCC API integration for location-based TV channel data. Features automatic intermodulation (IM) product avoidance, TV channel exclusion zones, and export compatibility with industry-standard tools.
- **Recent Updates:**
  - Security hardening: CSP `unsafe-eval` removed, sourcemaps disabled
  - New app tile rolled out across favicon, Apple touch icon, and PWA manifest
  - Service worker cache bumped to v2 to refresh stale icons
  - Sennheiser WSM export format
- **Key Features:**
  - Frequency range: 470–608 MHz
  - 10+ preset venue configurations
  - Export to Shure Wireless Workbench (WWB) and Sennheiser Wireless Systems Manager (WSM) formats
  - IM product calculation and avoidance
  - FCC database integration for real-time TV channel occupancy

#### SetFlow
- **URL:** https://setflow-beryl.vercel.app
- **Status:** Active
- **Version:** 2.4 | Last Updated: Jun 2026
- **Stack:** React, Vite, TypeScript, Tailwind, shadcn/ui
- **Description:** Setlist builder with flow analysis tools for musicians, music directors, and production managers. Combines BPM and musical key metadata with visual analysis tools to help build shows that flow well.
- **Recent Updates:**
  - Archive system: soft-delete & restore for songs and setlists (no destructive delete)
  - Multi-page PDF export (fit/split) with continuous numbering + per-setlist subtitles
  - Mobile polish: swipe-to-archive/remove, touch drag-reorder, persisted custom library order
  - True unset key/energy states + Unconfirmed tag; fixed oversized PDF exports (logo downscaling)
- **Key Features:**
  - BPM and musical key metadata per song (with true "unset" states)
  - Circle of Fifths key clash detection between consecutive songs
  - Energy flow analysis and visualization
  - Workspaces for multiple bands/projects
  - Multi-setlist management with JSON sharing and per-setlist subtitles
  - Archive system: soft-delete & restore for songs and setlists
  - Multi-page, stage-optimized PDF export (fit/split, for low-light environments)
  - Drag-and-drop ordering, touch swipe actions, and custom library sort

### SaaS / Production Tools

#### Filmore Advance
- **URL:** https://filmore-advance.vercel.app
- **Status:** Active
- **Version:** 4.3 | Last Updated: May 2026
- **Stack:** React, Vite, Tailwind, PWA, Sentry
- **Description:** Self-service venue advance portal for the artist FILMORE. Venues and promoters access the portal with an access code and can view tech riders, stage plots, hospitality requirements, and all production documentation needed to advance a show.
- **Access Code:** `DEMO` — Demo access to explore the portal
- **Recent Updates:**
  - Support show profiles added: drive-support & fly-support
  - Sentry profile + show-code tags for production error attribution
  - Feature-flag refactor (isSupport, needsHouseBackline) for cleaner profile gating
  - Security hardening: Sentry PII capture disabled, sourcemaps off
- **Key Features:**
  - Profile-based content filtering (full band, fly dates, trio, drive-support, fly-support)
  - Tech riders, input lists, stage plots, hospitality riders
  - Error boundaries, CSP hardening, Sentry error monitoring (PII capture disabled)
  - Chat engine with KB-driven responses
  - Document downloads
  - Mobile-responsive for on-site venue use

#### Tour Advance Portal
- **URL:** https://tour-advance-portal.vercel.app
- **Status:** Paused
- **Version:** 2.3 | Last Updated: Apr 2026
- **Stack:** React, Vite, TypeScript, Supabase
- **Description:** Multi-tenant advance portal template enabling any production manager to deploy their own venue advance system. Customizable show type system with per-document filtering, feature flags, and preset overrides. PM onboarding wizard, multi-tenant Supabase backend with RLS.
- **Recent Updates:**
  - Security hardening: explicit column allow-lists replaced `select('*')` across portal queries
  - Shared error sanitizer (`getSafeErrorMessage`) — generic strings client-side, full detail dev-only
  - SECURITY.md posture doc shipped; sourcemaps explicitly disabled
  - PWA icon refresh from TAP_App_tile_01 (favicon, apple-touch, 192/512, OG image)
- **Key Features:**
  - Custom show type system with preset overrides and feature flags
  - Per-document show type filtering for venue portals
  - PM onboarding wizard (4 steps)
  - Multi-tenant Supabase backend with row-level security
  - Quick topics for chat assistant (5 default tiles)

#### Filmore Gear Inventory
- **URL:** https://filmore-gear.vercel.app
- **Status:** Beta
- **Version:** 1.6 | Last Updated: Apr 2026
- **Stack:** React, HTML/CSS, localStorage, Tailwind
- **Description:** Comprehensive touring gear tracking system for FILMORE's production team. Tracks all gear across categories, manages consumables with quantity tracking, handles fly pack assignments for reduced-production travel dates, and includes role-based approval workflows for new gear acquisition requests.
- **Access Code:** `DEMO4` (gated by client-side SHA-256 hash; demo-grade only)
- **Recent Updates:**
  - Security hardening: SHA-256 access code gate (Web Crypto), SRI on CDN scripts
  - CSP tightened with `object-src 'none'`; HSTS bumped to 2yr + preload
  - AI discovery files removed to reduce reconnaissance surface
  - FLY pack management with crew baggage assignment
- **Key Features:**
  - Complete gear inventory with categories
  - Consumables tracking with quantity and restock alerts
  - Fly pack assignment and management
  - Role-based acquisition approval workflow
  - localStorage-based (works offline)

#### Filmore Booking
- **Status:** Beta — login-gated (email + password); public demo link coming
- **Version:** 1.0 | Last Updated: Jun 2026
- **Stack:** React, Vite, TypeScript, Tailwind, Supabase, PWA
- **Description:** Standalone booking and calendar app for the FILMORE camp. Gives management and the artist a single shared calendar to write to — removing the double-booking failures that come from booking separately — with a full inquiry → hold → confirmed pipeline.
- **Recent Updates:**
  - Live conflict / double-booking detection in the booking composer
  - Universal calendar picker + desktop split master-detail view
  - 3-level Department → Role → Individual personnel picker
  - Self-serve team management (managers add/remove members by email + role)
- **Key Features:**
  - Calendar grid + list + detail drawer with a status pipeline (inquiry → hold → confirmed → completed)
  - Live double-booking / conflict detection at entry time
  - 3-level Department → Role → Individual personnel picker with soft-archive and restore
  - Email + password auth with manager / member roles (row-level security)
  - Mobile-first PWA with FILMORE branding and a desktop split master-detail view

#### Filmore HQ
- **Status:** Retired (no live URL)
- **Version:** 1.1 | Last Updated: Apr 2026
- **Stack:** React, Vite, Tailwind, Framer Motion, PWA
- **Description:** Central dashboard and app launcher for the FILMORE touring team. Consolidated all FILMORE touring web apps into a single PWA launcher with role-based access codes controlling which apps are visible based on user role. Now retired.
- **Key Features (legacy):**
  - Per-app info sheets with ⓘ icon (glass bottom sheet UI)
  - Global notes footer for team-wide announcements
  - Role-based access code gate (3 tiers: Management, Demo, Crew)
  - Liquid glass UI with backdrop-blur and ambient glows

#### Road Remit
- **Status:** Private
- **Version:** 1.1 | Last Updated: Apr 2026
- **Stack:** Vanilla JS, Vercel
- **Description:** Custom invoice generator built for the unique billing needs of touring crew, production managers, and freelance audio engineers. Streamlines the invoicing workflow for professionals on the road. This project is currently private.
- **Recent Updates:**
  - Security hardening: `jspdf` + `xlsx` self-hosted (CDN origins removed from CSP)
  - CSP locked to `script-src 'self'` plus modern directives (COOP, CORP, frame-ancestors, base-uri, form-action, object-src, manifest-src, worker-src)
  - New app tile rolled out across favicon, Apple touch icon, and PWA manifest
  - 4 export formats: PDF, Excel, HTML, plain text

#### Tour Flow App
- **Status:** Retired (no live URL)
- **Version:** 1.9 | Last Updated: Apr 2026
- **Stack:** React Native, Expo, TypeScript, Supabase, Zustand
- **Description:** Mobile tour management application for audio engineers and crew. Multi-crew collaboration, tour scheduling, gear inventory, input list management, and AI assistant integration. Now retired.

### Artist & Promo Sites

#### Filmore Bio (EPK)
- **URL:** https://filmore-bio.vercel.app
- **Status:** Active
- **Version:** 1.1 | Last Updated: Apr 2026
- **Stack:** Next.js 14, TypeScript, Framer Motion, Tailwind
- **Description:** Artist biography and electronic press kit (EPK) website for country music artist FILMORE. Features bio, tour dates, video gallery, press photos, and social media integration.
- **Recent Updates:**
  - Security hardening: Next bumped 14.0.4 → 14.2.23, CSP `unsafe-eval` removed
  - X-Powered-By disabled, production sourcemaps off, X-XSS-Protection dropped
  - ATYPICAL app tile rolled out across favicon and PWA manifest
  - AI discovery files removed to reduce reconnaissance surface

#### Filmore 1-Sheet
- **URL:** https://filmore-1sheet.vercel.app
- **Status:** Active
- **Version:** 2.3 | Last Updated: Apr 2026
- **Stack:** HTML, CSS, Supabase Analytics
- **Description:** Digital press 1-sheet for FILMORE featuring streaming statistics (520M+ total streams), Spotify listener demographics visualization, and key artist metrics. Press & Features section with 5 of 6 outlet links live.
- **Recent Updates:**
  - Management content refresh: brand partners, social counts, bio, section reorder
  - Photo gallery rebuilt (2-left / hero / 2-right grid, mobile-optimized)
  - Security hardening: CSP `unsafe-inline` removed (JSON-LD pinned via SHA-256 hash)
  - Press & Features section (6 outlets with analytics)

#### Deej Gala Music
- **URL:** https://deej-gala-music.vercel.app
- **Status:** Active
- **Version:** 1.1 | Last Updated: Apr 2026
- **Stack:** React, Vite, TypeScript, Tailwind, Framer Motion
- **Description:** Cyberpunk-styled artist showcase website for DEEJ GALA featuring parallax hero section, discography, photo gallery, and social links.
- **Recent Updates:**
  - Security hardening: CSP and HSTS headers added (tuned for Spotify embed + Google Fonts)
  - Sourcemaps disabled in production build
  - New app tile rolled out across favicon, Apple touch icon, and PWA manifest

#### DDR Health & Fitness
- **URL:** https://ddr-healthandfitness.vercel.app
- **Status:** Active
- **Version:** 1.1 | Last Updated: Apr 2026
- **Stack:** React, Vite, TypeScript, Tailwind, Framer Motion
- **Description:** Professional website for Nashville-based personal trainer David D. Rogers. Features scroll-triggered animations, service package breakdowns, and contact integration.
- **Recent Updates:**
  - Security hardening: CSP and HSTS added (JSON-LD pinned via SHA-256 hash)
  - Formspree allowlisted in `connect-src`/`form-action`; sourcemaps disabled
  - npm audit fix: 7 vulns resolved (5 high, 2 moderate)

#### YEEHAW
- **URL:** https://yeehaw-beta.vercel.app
- **Status:** Active
- **Version:** 1.1 | Last Updated: Apr 2026
- **Stack:** Pure HTML, CSS
- **Description:** Minimal promotional landing page for the FILMORE x Pitbull collaboration single. Features YouTube embed and streaming platform CTAs.
- **Recent Updates:**
  - Security hardening: CSP locked to `script-src 'none'` (no JS on this site)
  - HSTS bumped to 2 years, preload-ready
  - New YEEHAW_App_Black tile rolled out across favicon, apple-touch, and PWA icon
  - AI discovery files removed to reduce reconnaissance surface

---

## Architecture Patterns

All projects in this portfolio follow consistent design patterns:

- **Config-driven architecture:** Centralized configuration files for easy customization
- **Dark theme:** #0a0a0a backgrounds with neutral grays across all projects
- **Mobile-first:** Responsive design prioritizing mobile viewport
- **Offline-first where possible:** localStorage over backend for user-local data (touring means unreliable internet)
- **Security headers:** All Vercel deployments include CSP, HSTS, XSS protection, X-Frame-Options, Referrer-Policy, and Permissions-Policy
- **PWA support:** Progressive Web App capabilities for on-site touring tools

## April 2026 Portfolio-Wide Security Hardening

In April 2026, all 11 active projects underwent a security hardening pass driven by a vibe-coding-vulnerabilities research synthesis. Common patterns applied:

- CSP `unsafe-eval` removed wherever possible; `unsafe-inline` removed where the build allows (inline JSON-LD pinned via SHA-256 hash where present)
- HSTS bumped to 2 years with `preload`
- Production sourcemaps explicitly disabled
- AI discovery files (`llms.txt`, `llms-full.txt`, `index.html.md`) removed from per-project sites to reduce reconnaissance surface (FiL Hub itself retains them as the discovery entry point)
- Dependency audits: `npm audit fix` applied where non-breaking
- Modern CSP directives added: `frame-ancestors 'none'`, `base-uri 'self'`, `form-action 'self'`, `object-src 'none'`, `upgrade-insecure-requests`
- Project-specific work as documented per project above

Two projects retired: **Filmore HQ** and **Tour Flow App**.

---

## Contact

FiL Hash is available for freelance work and collaboration on audio tools, creative tech, and touring production solutions.

- **Email:** filhashmore@protonmail.com
- **GitHub:** https://github.com/filhashmore
- **X/Twitter:** https://x.com/FiLHashDev
- **Location:** Nashville, TN