chore(certifications): add NVIDIA Generative AI Multimodal badge

[cuberhaus]

Summary

Adds the NVIDIA-Certified Associate: Generative AI Multimodal badge (issued Jun 2026), placed before the existing Generative AI LLMs badge.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Docs / chore
• Breaking change

Checklist

• AGENTS.md updated if conventions, commands, or skills changed (N/A — no convention change; reuses existing nvidia issuer icon)
• Tests added / updated (or N/A — existing content-parity / data-integrity / content-schemas / portfolio-content suites cover this; all 50 pass)
• No new secrets, credentials, or API keys committed
• Linked issue or context: N/A

Notes for reviewers

• New entry inserted at array index 1 in src/data/certifications.json; positional issued keys renumbered across locales/{en,es,ca}/certifications.json (new key 1 = Jun 2026, localized per locale).
• Badge details sourced from the public Credly URL (name, issuer, badge image); link normalized to the credly.com/badges/<id> form used by the other badges.

[cursor]

Security Review — PR #189

Result: No high-confidence vulnerabilities found

This PR adds one certification record and reindexes locale issued dates. The diff is limited to static JSON in src/data/certifications.json and locales/{en,es,ca}/certifications.json. No executable code, dependencies, CI, or auth configuration changed.

Scope reviewed

Area	Assessment
Injection (SQL, command, template, path traversal)	Not applicable — no queries, shell execution, templating, or filesystem access
Authn / authz	Not applicable — static portfolio content
Secrets / token leakage	None — no credentials or tokens in the diff
XSS	No new risk — name, issuer, and issued render as Astro text nodes; issuerIcon: "nvidia" is an existing enum value rendered via the whitelisted ISSUER_ICON_PATHS map
SSRF / request forgery	No new risk — the new entry has no fallback field, so it does not trigger the existing client-side fetch(link.href) fallback logic in Certifications.astro
Unsafe deserialization	Not applicable
Dependency / supply-chain	No changes — package.json / lockfiles untouched

URL handling (informational)

New URLs follow the same pattern as existing certifications:

• link: https://www.credly.com/badges/... (HTTPS external credential page)
• badgeImage: https://images.credly.com/... (HTTPS CDN image)

These satisfy the existing Zod credentialUrl / imageUrl constraints in content-schemas.ts (https:// only for external URLs). Links are emitted with rel="noopener noreferrer".

Uncertain / out of scope

• Third-party asset trust: Badge images load from images.credly.com. Compromise of that CDN could affect image content site-wide; this is pre-existing architecture, not introduced by this PR.
• Credly URL authenticity: Assumed author-controlled content; not a code-level vulnerability.

---

Automated security review — content/data change only; no remediation required.

  

_{Sent by Cursor Automation: Find vulnerabilities}