ci/docs: CodeQL for JavaScript, TypeScript, and Python

.github/codeql/README.md

@@ -0,0 +1,115 @@
+# CodeQL Setup for the-method
+
+This folder contains the CodeQL configuration for security and code quality scanning in this repository.
+
+## What each file does
+
+- `.github/workflows/codeql.yml`
+  - Defines when scans run and how GitHub Actions executes CodeQL for both frontend and backend.
+- `.github/codeql/codeql-config.yml`
+  - Defines which folders to include and ignore during analysis for all supported languages in this repo.
+
+## CodeQL workflow breakdown (`.github/workflows/codeql.yml`)
+
+### `name: CodeQL`
+The display name in the Actions tab.
+
+### `on.pull_request.branches` and `on.push.branches`
+```yaml
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+```
+Runs scans when PRs target `main`, and when commits are pushed to `main`.
+
+### `permissions`
+```yaml
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+```
+Uses least-privilege permissions. `security-events: write` is required so CodeQL can upload findings.
+
+### Language setup (current)
+```yaml
+with:
+  languages: javascript-typescript, python
+```
+This workflow currently runs analysis for both JavaScript/TypeScript (frontend) and Python (backend).
+
+### Checkout step
+```yaml
+with:
+  fetch-depth: 0
+```
+- `fetch-depth: 0` keeps full git history (safe default for analysis and troubleshooting).
+
+### Initialize CodeQL
+```yaml
+uses: github/codeql-action/init@v3
+with:
+  config-file: ./.github/codeql/codeql-config.yml
+```
+Starts the CodeQL engine and loads `.github/codeql/codeql-config.yml`.
+
+### Analyze
+```yaml
+uses: github/codeql-action/analyze@v3
+```
+Executes queries and uploads results to GitHub Security.
+
+## Config breakdown (`.github/codeql/codeql-config.yml`)
+
+### `paths-ignore`
+Generated/build/runtime artifact paths and cache folders are excluded to reduce noise and runtime:
+
+```yaml
+paths-ignore:
+  - '**/node_modules/**'
+  - '**/dist/**'
+  - '**/build/**'
+  - '**/coverage/**'
+  - '**/logs/**'
+  - '**/.venv/**'
+  - '**/__pycache__/**'
+  - '**/*.min.js'
+  - '**/.pytest_cache/**'
+  - '**/.mypy_cache/**'
+  - '**/.next/**'
+```
+
+## Best practices
+
+1. **Keep trigger scope intentional.**
+  Use branch filters (`main`) to control cost and noise.
+2. **Keep language list explicit.**
+   CodeQL should only review languages with meaningful source code.
+3. **Exclude generated/vendor artifacts.**
+   Keep caches, dependencies, build outputs, logs, and minified files in `paths-ignore`.
+4. **Pin to stable major action versions.**
+   `@v3` is the current stable major for CodeQL actions.
+5. **Review alerts regularly.**
+   Handle high/critical findings made by the CodeQL bot first and solve with documented reasoning for accepting or rejecting the recommended fix.
+
+## Maintenance examples
+Keeping this updated as code and language coverage evolve is important. Here are common maintenance changes.
+
+### Keep language scope aligned with this repository
+This workflow currently analyzes JavaScript/TypeScript and Python:
+
+```yaml
+with:
+  languages: javascript-typescript, python
+```
+
+Only change this value when this repository adds production code in another supported language.
+
+### Exclude another generated folder
+Add a glob to `paths-ignore`, for example:
+
+```yaml
+- '**/generated/**'
+```

.github/codeql/codeql-config.yml

@@ -0,0 +1,14 @@
+# CodeQL config for The Method
+# Exclude generated/build/runtime artifact paths and cache folders
+paths-ignore:
+  - '**/node_modules/**'
+  - '**/dist/**'
+  - '**/build/**'
+  - '**/coverage/**'
+  - '**/logs/**'
+  - '**/.venv/**'
+  - '**/__pycache__/**'
+  - '**/*.min.js'
+  - '**/.pytest_cache/**'
+  - '**/.mypy_cache/**'
+  - '**/.next/**'

.github/workflows/codeql.yml

@@ -0,0 +1,32 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript, python)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript, python
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

README.md

@@ -1,5 +1,24 @@
 # The Method
 A website that allows users to create, optimize, practice behavioral interviews, and apply for jobs all in one place.
+- Create new latex based resumes that you can download
+- Optimize resumes with key ideas and AI powered feedback
+- Pratice inteviews questions that are commonly asked
+- Apply to new jobs in your field
+
+## Features
+### Current
+- Home page
+- Footer page contents
+- Website theme switcher
+- Basic resume generator
+
+### Work In Progress
+- Login/signup system
+- Supabase database system
+
+### Future
+- Hosting website on Vercel
+- Interview prep section
 
 ## Tech Stack
 <h3 style="margin-bottom: 5px;">Frontend</h3>
@@ -11,13 +30,66 @@ A website that allows users to create, optimize, practice behavioral interviews,
 
 - Python + FastAPI
 - PostgreSQL + SQLAlchemy
+- Supabase
 
 <h3 style="margin-bottom: 5px;">DevOps</h3>
 
 - GitHub Actions for CI/CD
 - Docker
 
 
+<h3 style="margin-bottom: 5px;">Hosting</h3>
+
+- Vercel
+
+## Project Folder Structure
+
+```text
+the-method/
+├── backend/
+│   ├── Dockerfile
+│   ├── main.py
+│   ├── models.py
+│   ├── requirements.txt
+│   ├── resume_analyzer.py
+│   ├── database/
+│   │   ├── __init__.py
+│   │   ├── engine.py
+│   │   └── models.py
+│   ├── interview/
+│   │   ├── refresh.py
+│   │   └── service.py
+│   └── llm/
+│       ├── client.py
+│       ├── prompts.py
+│       ├── service.py
+│       └── test_llm.py
+├── frontend/
+│   ├── Dockerfile
+│   ├── index.html
+│   ├── package.json
+│   ├── vite.config.js
+│   ├── src/
+│   │   ├── App.jsx
+│   │   ├── main.jsx
+│   │   ├── components/
+│   │   │   ├── FileUpload.jsx
+│   │   │   ├── ResumePreview.jsx
+│   │   │   └── ...
+│   │   ├── pages/
+│   │   │   ├── HomePage.jsx
+│   │   │   ├── FormPage.jsx
+│   │   │   └── ...
+│   │   └── styles/
+│   │       ├── styles.css
+│   │       └── ...
+├── docker-compose.yml
+├── README.md
+└── test-prompts/
+    └── test.txt
+```
+
+
 ## Deploy the website
 ### App can be deployed via 4 method(3 with Docker & 1 with npm):
   - (1), (2), & (3): Testing frontend & backend logic, up to preference:

backend/main.py

@@ -48,6 +48,8 @@ async def chat_endpoint(request: ResumeRequest):
         request (ResumeRequest): The request body containing the user's prompt.
     Returns:
         dict: The LLM's response or an error message.
+    Raises:
+        HTTPException: If the LLM returns an error response (500).
     """
 
     # Prepend system prompt to messages
@@ -71,6 +73,8 @@ async def generate_resume_endpoint(request: GenerateResumeRequest):
         request (GenerateResumeRequest): The request body containing the user's prompt.
     Returns:
         dict: The LLM's response or an error message.
+    Raises:
+        HTTPException: If the resume generation fails (500).
     """
 
     # extract data from HTTP request
@@ -92,9 +96,11 @@ async def optimize_resume_endpoint(request: OptimizeResumeRequest):
     Optimize resume for ATS according to job description.
 
     Args:
-         request (OptimizeResumeRequest): The request body containing the user's prompt.
+        request (OptimizeResumeRequest): The request body containing the user's prompt.
     Returns:
-         dict: The LLM's response or an error message.
+        dict: The LLM's response or an error message.
+    Raises:
+        HTTPException: If the resume optimization fails (500).
     """
 
     resume_dict = request.resume.model_dump()
@@ -117,6 +123,8 @@ async def analyze_resume_endpoint(request: AnalyzeResumeRequest):
         request (AnalyzeResumeRequest): The request body containing the user's prompt.
     Returns:
         dict: The analysis results or an error message.
+    Raises:
+        HTTPException: If the input is invalid (400) or an internal error occurs (500).
     """
 
     try:
@@ -140,9 +148,11 @@ async def generate_cover_letter_endpoint(request: CoverLetterRequest):
     Generate a cover letter based on resume and job description.
 
     Args:
-        request (OptimizeResumeRequest): The request body containing the user's prompt.
+        request (CoverLetterRequest): The request body containing the user's prompt.
     Returns:
         dict: The generated cover letter or an error message.
+    Raises:
+        HTTPException: If the cover letter generation fails (500).
     """
 
     resume_dict = request.resume.model_dump()
@@ -163,6 +173,16 @@ async def generate_cover_letter_endpoint(request: CoverLetterRequest):
 
 @app.get("/interview-questions/{company}")
 def get_interview_questions_endpoint(company: str):
+    """
+    Retrieve interview questions for a specified company.
+
+    Args:
+        company (str): The name of the company to retrieve interview questions for.
+    Returns:
+        dict: The interview questions data for the company, or an error message if not found.
+    Raises:
+        HTTPException: If the company is not found or has no data (404).
+    """
 
     data = get_questions(company)