CVify Pro System Documentation
Official engineering specification, architecture blueprints, ATS algorithms, and security protocols.
The 8-Layer Career Lifecycle: From Resume to Offer
CVify Pro is engineered around an integrated 8-Layer Career Pipeline. Individual features (ATS, Resume Builder, Portfolio, Cover Letters) are not isolated tools — they operate as coordinated stages in a closed-loop hiring lifecycle.
The 8-Stage Lifecycle Diagram
[Stage 1: Master Profile] ──▶ Single Source of Truth (SSOT) living career asset
│
▼
[Stage 2: AI Analysis] ──▶ 9-Stage AST Parsing Pipeline (see Resume Intelligence v5.0)
│
▼
[Stage 3: ATS Alignment] ──▶ Keyword Gap Matching against Target Job Descriptions
│
▼
[Stage 4: Cover Letter] ──▶ Tailored Executive Narratives matched to Company & Role
│
▼
[Stage 5: Portfolio Lab] ──▶ SEO-Optimized Web Presence with Live GitHub Telemetry
│
▼
[Stage 6: Job Matching] ──▶ JD-to-Profile Calibration & Qualification Benchmarking
│
▼
[Stage 7: AI Coach & HUD] ──▶ Loophole Identification & 6-Second Recruiter Simulation
│
▼
[Stage 8: Offer & Land] ──▶ High-Confidence Application Delivery with Verified ProofWhy the Coordinated Pipeline Matters
Unified Career Data
ATS findings and improvement suggestions can be directly applied to your Master Profile, which in turn updates your live Portfolio and recalibrates your AI Representative.
Continuous Feedback Loop
ATS Scan ➔ Loophole Checklist ➔ Apply AI Coach Fixes ➔ Profile Rescan ➔ Quantified Score Improvement.
Master Profile Architecture vs. Derived Resumes
In CVify Pro, the Master Profile is a permanent, living career database. Resumes, portfolios, cover letters, and AI knowledge bases are lightweight, specialized projections derived from this single source of truth.
Master Profile Entity Relationship
┌───────────────────────────────────┐
│ MASTER PROFILE (SSOT) │
│ All verified career history, │
│ skills, metrics, and GitHub stats│
└─────────────────┬─────────────────┘
│
┌─────────────────────────────┼─────────────────────────────┐
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Tailored Resumes │ │ Web Portfolio │ │ AI Representative│
│ Role-specific │ │ 13 live themes, │ │ Verified Q&A, │
│ ATS projections │ │ custom domain DNS│ │ candidate proof │
└──────────────────┘ └──────────────────┘ └──────────────────┘Architectural Distinction
The Six Coordinated AI Career Engines
CVify Pro hosts 6 autonomous, specialized AI and deterministic processing engines operating under a unified Career Operating System.
1. ATS Intelligence Engine
Hybrid evaluation combining deterministic heuristic scoring (40% Completeness, 35% Quantification, 25% Impact Verbs) with semantic LLM validation.
2. AI Career Coach & Debrief HUD
Generates prescriptive loophole checklists, concrete bullet rewrites, and 6-second recruiter first-impression simulations.
3. Portfolio Theme Engine v4.0
Pluggable 5-layer rendering pipeline hosting 13 modern themes with zero monolithic coupling.
4. AI Candidate Representative
Candidate-grounded representative bot citing verified GitHub commits and project repositories to answer recruiter questions.
5. Job Description Matcher
Parses employer job postings to compute stack alignment percentages and identify exact missing keywords.
6. Resume Studio & AST Sync
Bidirectional sync between visual drag-and-drop builder, structured JSON AST, and vector PDF template engines.
6-Second Recruiter First-Impression Simulation
While ATS engines check machine compliance, human recruiters scan resumes in 6 to 10 seconds. CVify Pro's Recruiter Simulation engine analyzes visual hierarchy, headline strength, and skimming friction.
Recruiter Review Metric Weights
Header & Title Match
Headline clarity and seniority alignment
Current Company & Role
Recent career trajectory and tenure
Quantified Proof
Numbers, percentages, and metrics scanning
⚠️ Note: The time breakdowns above reflect CVify Pro's internal analytical scoring model — not a universal law of recruiter behavior. They are derived from UX research on visual skimming patterns and used by CVify's simulation algorithm to weight resume elements. Actual recruiter behavior varies by industry, seniority, and role.
Custom Domain & DNS Setup Guide
CVify Pro allows users to map their personal domain (yourname.com) directly to their live portfolio with automated SSL certificates.
DNS Configuration Steps
Add CNAME Record
In your domain registrar (Namecheap, GoDaddy, Cloudflare), point CNAME 'www' or '@' to 'cname.cvifypro.vercel.app'.
Enter Domain in Dashboard
Go to Profile Settings ➔ Custom Domain and enter your full domain name.
Automated SSL Issuance
Our edge network provisions an automated Let's Encrypt SSL certificate within 2-5 minutes.
Live Verification
Status badge turns green 'Connected' and your custom domain goes live worldwide.
Recruiter Telemetry & Candidate Privacy Shield
CVify Pro provides real-time recruiter visit analytics while enforcing strict candidate privacy safeguards.
Telemetry Data Scope
The Diamond Economy: Transparent Zero-Subscription Model
CVify Pro rejects predatory recurring monthly subscriptions. Candidates only pay for the exact compute and AI tokens they consume via transparent Diamond top-ups.
Feature Compute & Diamond Matrix
| Feature | Diamond Cost | Free Allowance |
|---|---|---|
| Profile & Resume Editing | 0 💎 (100% Free) | Unlimited forever |
| Vector PDF Export | 0 💎 (100% Free) | Unlimited standard downloads |
| Magic AI Resume Import | 30 💎 | Initial signup bonus (100 💎) |
| Full AI ATS Scan & Audit | 50 💎 | First same-day rescan within 24h is FREE |
| Subsequent Rescan (24h+ or 2nd+) | 25 💎 | 50% discounted follow-up price |
| AI Cover Letter Studio | 30 💎 | Tailored to company & JD |
| AI Intent Command Bar | 30 💎 | Natural language editing |
Platform Overview
CVify Pro is not just a resume builder — it is a Career Intelligence Ecosystem. The platform solves the "Black Box" problem of Applicant Tracking Systems by giving users a real-time, AI-backed auditor that mimics Fortune 500 hiring pipelines. The architecture prioritizes Aesthetics, Agency, and Authority.
For Job Seekers
Build ATS-friendly resumes, generate targeted cover letters, and host a live, SEO-optimized digital portfolio with zero coding. Get honest, empathetic feedback that helps you grow.
For Recruiters
View candidates with verified GitHub data, actual project proof, transparent AI-matched skill alignments, and a 6-second first impression verdict. No more guessing.
Context-Aware Intelligence
The AI adapts scoring, keywords, and coaching tone based on experience level (Fresher → Senior) and market mode (Standard, Pakistan HR, Freelance, Remote).
Anti-Hallucination Engine
6 strict rules ensure AI feedback only references actual resume content (no invention). Rules include: cite existing bullets, no fabricated metrics, no invented companies. Hybrid scoring (AI × 0.6 + Server × 0.4) prevents random score inflation.
Quick Setup (3 Min)
Create Account
Click "Signup" and verify your professional email. You'll receive 100 free diamonds to start.
Complete Your Profile
Add your name, headline, professional summary, work experience, education, and skills in Profile Settings.
Sync GitHub (Optional)
Connect your GitHub URL to automatically pull repo counts, languages, and contribution stats into your portfolio.
Go Live!
Your Public Portfolio is instantly live at cvifypro.vercel.app/p/your-username — share it with recruiters!
Magic AI Import
Don't start from scratch. Our Magic AI Import parses your existing PDF or DOCX resume and instantly builds a professional CVify Pro profile.
Key Features
Semantic Parsing
AI understands that 'Software Engineer' is a Role and 'Python' is a Skill, mapping them to the correct sections with 98% accuracy.
Instant Hydration
Your entire professional timeline (Experience, Education, Projects) is populated in under 20 seconds.
How to Use
Open Resume Builder
Click the 'Magic Import' button in the builder header.
Upload File
Select your PDF or DOCX resume (Max 5MB).
AI Analysis
Wait while our AI maps your story. Cost: 30 💎.
AI Intent Mode
The Intelligence Command Bar allows you to optimize your resume using natural language. No more manual editing — just tell the AI what you want.
Example Commands
Pricing & Logic
Every execution costs 30 💎. The AI analyzes your entire resume context before applying the requested changes to ensure consistency.
Job Matcher (JD Analysis)
The Job Matcher mimics a real Applicant Tracking System (ATS). It audits your resume against a specific job description to find missing keywords and gaps.
Compatibility Score
A real-time percentage score showing how well you match the JD.
Keyword Gaps
Identifies exactly which skills or tools are missing from your profile.
Usage Guide
Select Matcher Tab
Go to the 'Matcher' section in the Resume Builder.
Paste JD
Paste the job requirements from LinkedIn or any job board.
Analyze
Click 'Analyze Job Match' (50 💎). You'll get a detailed strategy report.
Resume Intelligence Audit
The Resume Intelligence Audit is a dual-mode validation engine designed to evaluate resumes dynamically. It bridges the gap between static content writing and modern ATS criteria, ensuring your resume meets recruiter expectations instantly.
Zero-Latency Live Scoring
Heuristic client-side algorithms recalculate metrics in real-time as you type, giving instant visual feedback without API cost or delay.
Magic Import Synchronicity
Leverages structure models generated during AI imports to prioritize deep extraction analyses and structural evaluations.
How the Audit Engine Works
The engine operates using a fallback architecture. When you upload a resume via Magic Import, it receives structural scores directly from the server. As you manually edit or create a resume from scratch, the client-side engine executes local validation functions in real-time to compute scores on-the-fly.
Technical Diagrams & Data Workflows
1. Technical System Architecture
Demonstrates the flow from inputs (Magic Import or Manual Editor) through the Redux store, and shows how the merge selector chooses between parsingAnalysis and live computed scores.
┌──────────────────────────────────────────────────────────┐
│ INPUTS │
│ ┌──────────────────────────┐ ┌──────────────────────┐ │
│ │ Magic Import (File Upload)│ │ Manual Editor Build │ │
│ └─────────────┬────────────┘ └──────────┬───────────┘ │
└────────────────┼──────────────────────────┼──────────────┘
▼ ▼
┌──────────────────────────────────────────────────────────┐
│ REDUX STORE │
│ [ parsingAnalysis ] [ currentResume ] │
└────────────────┬──────────────────────────┬──────────────┘
│ │
▼ ▼
┌──────────────────────────────────────────────────────────┐
│ FALLBACK MERGER │
│ Is parsingAnalysis present? │
│ ├─▶ YES: Use parsed server scores │
│ └─▶ NO: Run live client Heuristic Engine │
└────────────────────────────┬─────────────────────────────┘
▼
┌──────────────────────────────────────────────────────────┐
│ RESUME ANALYZER VIEW │
│ [ Completeness: 40% ] [ Quantification: 35% ] [ Impact: 25% ] │
└──────────────────────────────────────────────────────────┘2. Data Flow Diagram (DFD Level 1)
Traces how data moves from user inputs, through the parser service, to databases/Redux stores, and how final scoring metrics are assembled for UI rendering.
┌────────┐ PDF / DOCX File ┌─────────────┐
│ User │────────────────────────────────────────▶│ P1: Upload │
└────▲───┘ └──────┬──────┘
│ │ Raw Text
│ Visual Dashboard ▼
┌────┴──────┐ parsingAnalysis ┌─────────────────────────────┐
│ Render UI │◀─────────────────────────────│ P2: Parse & Extract (Gemini)│
└────▲──────┘ └──────────────┬──────────────┘
│ │ Save Resume
│ finalScores ▼
┌────┴────────┐ liveScores ┌─────────────────┐ Save ┌──────────────┐
│ P5: Merger │◀────────────────│ P4: Live Engine │◀──────▶│ D2: Database │
└────▲────────┘ └────────▲────────┘ └──────────────┘
│ │
└─────────── currentResume ─────────┘3. Decision Tree & Scoring Logic Flow
A logical map showcasing how completeness, quantification, and impact are calculated mathematically, leading to overall category verdicts.
User opens Analyzer View
│
▼
Is parsingAnalysis in Redux?
├── YES ──▶ Use AI parser scores (Magic Import)
└── NO ──▶ Run live computeScores(currentResume)
│
▼
┌───────────┴───────────┐
│ Live Score Algorithms │
└───────────┬───────────┘
├─▶ Completeness (Weight: 40%) ──▶ Checks 8 structural fields
├─▶ Quantification (Weight: 35%) ─▶ Checks metrics & stats count
└─▶ Impact Language (Weight: 25%) ─▶ Matches 26 action verbs
│
▼
Overall Weighted Percentage calculated
│
├─▶ Overall >= 70% ──▶ "Good" (Green UI status)
├─├─▶ Overall >= 40% ──▶ "Fair" (Amber UI status)
└──▶ Overall < 40% ───▶ "Needs Work" (Red UI status)Scoring Methodology
The audit engine splits evaluations into three metrics:
Completeness Score (40% Weight)
Checks for the presence of 8 crucial resume modules: Full Name, Email, Profile Summary, Phone Number, Work Experience, Education, Skills, and Projects. Lacking any of these triggers warning flags as they are ATS compliance requirements.
Measurable Results (35% Weight)
Analyzes all bullet points in your work experience to count metrics, stats, percentages, and dollar amounts. Resumes with quantifiable impact (e.g. "Optimized DB speed by 40%") receive significantly higher scores.
Impact Language (25% Weight)
Cross-references the first word of every bullet point against a library of 26 active action verbs (e.g. "Architected", "Spearheaded", "Refactored"). Replaces weak filler phrases ("Responsible for") with strong, direct verbs.
Master Architecture Constitution (STRUCTURE.md)
CVify Pro operates under a strict Micro-SaaS Sub-Application Architecture. The platform is not a monolithic dashboard — it is a Career Operating System hosting autonomous, isolated product modules.
The 10 Golden Engineering Laws
1. Failure Isolation Guarantee
If any sub-application throws a runtime exception, local ErrorBoundaries prevent the parent Career OS shell or sibling applications from crashing.
2. Independent Micro-SaaS Routing
Every sidebar feature owns dedicated sub-routes: Landing (/), Workstation (/scan), Mission Reports (/reports), History (/history), and Guide (/guide).
3. Regional Market Adaptation
Intelligence algorithms calibrate scoring based on 4 distinct hiring markets: Standard Global, US Remote ($80k+), European Union (GDPR), and MENA / Gulf.
4. Canonical DTO Contract
All AI and deterministic parsers must output into a single strongly-typed CanonicalResumeDTO contract before downstream consumption.
Sub-Application Pipeline Flow
┌────────────────────────────────────────────────────────────┐
│ CAREER OS SHELL │
│ [ Global Auth ] [ Diamonds Economy ] [ Sidebar Shell ] │
└──────────────────────────────┬─────────────────────────────┘
│
┌──────────────┴──────────────┐
│ Local Error Boundary Sandbox│
▼ ▼
┌──────────────────────────────┐ ┌───────────────────────────┐
│ ATS INTELLIGENCE SUB-APP │ │ PORTFOLIO ENGINE SUB-APP│
│ ├─ /ats (Landing Page) │ │ ├─ /p/:slug (Theme Engine)│
│ ├─ /ats/scan (Workstation) │ │ ├─ HUD Analytics Dock │
│ ├─ /ats/reports (Debrief HUD)│ │ └─ Universal Floating Nav │
│ ├─ /ats/history (Timeline) │ └───────────────────────────┘
│ └─ /ats/guide (Mini-Course) │
└──────────────────────────────┘Token-Efficient Technical Architecture & AI Documentation Standards
CVify Pro enforces a strict Token-Efficient Technical Documentation Standard (.agents/documentation.md). Built specifically for AI-native engineering, this standard minimizes token waste, prevents server load, eliminates hallucination risks, and ensures single-source-of-truth reliability across 100+ modules.
0. AI Behavioral Posture & Critical Peer Policy
Independent Architectural Audit
AI coding agents must critically evaluate every request for security leaks, token inefficiencies, and structural flaws before making code changes.
Strict Anti-Sycophancy
No submissive fillers ('yes sir', 'as you wish', 'apologies'). State technical boundaries, errors, and optimizations directly as peer engineers.
Zero Token/Image Waste
Exclude generative image assets from documentation workflows; utilize ASCII flowcharts and client-rendered Mermaid diagrams exclusively.
SaaS Cost & Rate Controls
Actively enforce monetization guards, rate limits, and token budgets across both client and server boundaries.
1. Golden Rule: Zero Token Waste
2. Diagram Standard: ASCII-First Architecture
All architectural flows and sequence diagrams in CVify Pro are authored in raw ASCII art. This delivers zero server load, zero AI image token consumption, Git diff readability, dark-mode auto-adaptation, and instant copy-paste usability:
┌─────────────────┐ Token-Efficient Payload ┌─────────────────┐
│ User / Recruiter│────────────────────────────────────▶│ API Gateway │
└────────┬────────┘ └────────┬────────┘
▲ │
│ Render Hydrated UI ▼
┌────────┴────────┐ Normalized DTO Contract ┌─────────────────┐
│ Public Profile │◀────────────────────────────────────│ ViewModel Layer │
└─────────────────┘ └─────────────────┘3. Content Structure: Inverted Pyramid
┌────────────────────────────────────────────────────────────┐ │ 1. ONE-LINE SUMMARY │ 10 words max — core takeaway │ ├───────────────────────────┼────────────────────────────────┤ │ 2. KEY POINTS │ 3–5 high-impact bullet items │ ├───────────────────────────┼────────────────────────────────┤ │ 3. TECHNICAL DETAILS │ Schema tables & code blocks │ ├───────────────────────────┼────────────────────────────────┤ │ 4. EDGE CASES │ Explicit validation boundaries │ └────────────────────────────────────────────────────────────┘
4. Schema-First API & AI Prompt Contracts
POST /api/v1/resumes/audit
Headers: Authorization: Bearer <JWT>
Body:
resumeId: string required (MongoDB ObjectId)
jdText: string optional (max: 4000 chars)
market: enum ['global', 'us_remote', 'eu', 'mena']
Response: 200 { score, breakdown, confidence, gaps }Role: ATS Optimization Expert. Direct, no filler. Input: resumeText (max 5000 chars), jobDescription (max 2000 chars) Output: Valid JSON matching strict schema Rules: - NEVER explain reasoning outside JSON - NEVER emit markdown formatting inside JSON - MAX output budget: 500 tokens
5. SaaS Resource Budgets & Review Checklist
Pre-Ship Documentation Checklist
- Zero generative image dependencies (ASCII flowcharts only).
- No filler words ("please", "very", "as you can see").
- Inverted pyramid format with 10-word summary headline.
- Language tags on all code blocks with verified syntax.
- Max 3 levels of nesting with strict token limit under 500 tokens per section.
Dual-Theme & Light Design System v2.0
CVify Pro utilizes an enterprise SaaS dual-theme design system inspired by Linear, Vercel, Framer, and Stripe. The system provides two distinct visual personalities: Daylight Executive (Light) and Midnight Pro (Dark), unified by a shared semantic CSS variable cascade.
Core Light Design Principle
"CVify Pro in Light Mode should look white first, sage second, mauve third — clean, calm, and executive. Never pastel, washed out, or childish."
Dual-Theme Palette Matrix
#FAFBFA (60% UI)#FFFFFF (Surface)#66907D#906688#CCF6E3 (Tints only)#09090b (Midnight)#18181b (Surface)#3b82f6#a855f7rgba(59,130,246,0.1)Strict CTA Button Hierarchy (Non-Negotiable)
Global ATS Score Semantic Tokens
ATS score colors are centralized in index.css rather than scattered across individual card components:
--ats-critical
--ats-needs
--ats-fair
--ats-strong
--ats-excellent
Shell Architecture Refactor
Sidebar & Header Modernization
Replaced hardcoded slate-950 dark classes with dynamic CSS variable tokens (var(--surface), var(--border), var(--text-primary)), while preserving active module identity accents.
ThemeToggle & Inputs
ThemeToggle dynamically syncs with ThemeContext and localStorage without DOM flickering. All form inputs utilize theme-aware border rings.
Resume Intelligence Platform v5
Resume Intelligence Platform v5 is a 9-Stage Decoupled Parsing & Healing Pipeline. The parser is treated strictly as an input module; layout analysis, text re-sequencing, validation, repair, and confidence scoring run as standalone deterministic engines.
9-Stage Pipeline Architecture
[Input Document] ──► [Parser Matrix] (Gemini / OCR / DOCX / Deterministic)
│
▼
[Layout Engine] (DOM, Columns, Tables, Margin Safety)
│
▼
[Reading Order Engine] (Untangles Multi-Column Text Flow)
│
▼
[Section Detector] (Fuzzy Heading Classification)
│
▼
[CanonicalResumeDTO] (Strict Unified Schema Contract)
│
▼
[Validation Engine] (Flags Missing/Malformed Fields)
│
▼
[Repair Engine] (Auto-Heals Dates, URLs & Skills via Normalizer)
│
▼
[Confidence Engine] (0-100% Deterministic Section Certainty)
│
▼
[Benchmark Suite] (Automated CI/CD Regression Runner)Core Engines Breakdown
1. Layout & Reading Order
Detects Single vs Multi-Column text clustering, table grids, and re-sequences blocks top-to-bottom, left-to-right to fix column interleaving.
2. Section & DTO Mapping
Fuzzy regex detector classifies headers and maps raw parser data into CanonicalResumeDTO with contact, experience, education, skills, and projects.
3. Validation & Repair Engine
Checks email/phone/date syntax, auto-converts dates to ISO (YYYY-MM-DD), infers current jobs, and deduplicates skills via SkillNormalizer.
4. Confidence Engine & Benchmarks
Scores certainty 0-100% per section (Contact 25%, Experience 35%, Education 20%, Skills 20%). Validated via automated regression test suite.
Benchmark Suite Results
ATS v2.0 Micro-SaaS Engine
CVify Pro's ATS Intelligence System is an autonomous Micro-SaaS Sub-Application hosted at /ats. It audits your resume against real Workday, Taleo, and Greenhouse parsing algorithms.
Sub-Application Navigation Matrix
/ats (Landing Page)
Dual-mode scanner hero, 5-step journey, two-tier system breakdown, and interactive demo.
/ats/scan (Workstation)
Dual input (Upload PDF/DOCX or select Platform Resume), contextual parameters, and live telemetry.
/ats/reports (Debrief HUD)
Mission Debrief Report with score meters, status badges, keyword gaps, and AI coaching.
/ats/history & /ats/guide
Career Growth Timeline archive and interactive educational mini-course on ATS mechanics.
Contextual Parameters (4 × 4 JD Matrix)
The scanner adapts keyword weighting and prompt logic dynamically based on user selection:
Standard Global Tech · US Remote ($80k+ High Quantification) · European Union (GDPR / Clean Format) · MENA & Gulf Enterprise.
Entry-Level / Junior (0–2 Yrs) · Mid-Level Engineer (3–5 Yrs) · Senior / Staff (5+ Yrs) · Executive / Director.
Live Telemetry Pipeline
During execution, the scanner broadcasts real-time phase updates to the user:
Scan Cost: 50 💎. Re-scans of the same document within 24 hours cost 50% less (25 💎).
AI Career Coach & Mission Debrief HUD
The AI Career Coach is an Interactive Diagnostic HUD embedded directly within the ATS Mission Debrief Report (/ats/reports). It converts raw ATS scan scores into a structured, step-by-step optimization plan.
The 6 Core Coaching Modules
1. Alignment Meter (Potential Score)
Compares Current Score vs Potential Score after recommended fixes. Displays achievable score gains (e.g. +24% gain) and strategic advice.
2. Dealbreaker Reality Check
Scans hard requirements from the JD. Classifies gaps into CAN FIX vs HARD NO badges with direct advice before wasting time on applications.
3. Experience Gap Analysis
Direct side-by-side comparison of 'JD Requires' vs 'Your Resume Shows' with gap severity ratings and bridging strategies.
4. Section-by-Section Loopholes
Drills down into each section (Summary, Experience, Skills) with Issue Identified, Suggested Fix, and Recruiter Reality Check.
5. Quick Wins Checklist
Ranked list of highest-impact, lowest-effort actions. Labeled with LOW, MEDIUM, and HIGH effort tags for fast execution.
6. AI Bullet Improvements
Highlights weak bullets with critique, original text quote, and a fully rewritten, quantified MERN/tech replacement bullet.
Mission Report Status Badges
AI Cover Letter Generator
Generate personalized, role-specific cover letters in seconds. The AI performs a "Handshake" between your resume achievements and the company's mission.
3 Personality Styles
Professional
Formal, corporate tone. Perfect for banking, consulting, and government.
Creative
Bold, engaging tone for startups and design roles. Shows personality.
Enthusiastic
High-energy tone where culture fit matters. Great for tech startups.
How It Works
Select Style
Choose Professional, Creative, or Enthusiastic.
Paste JD
The AI extracts company name, role, and key requirements automatically.
Generate
In 10-15 seconds, your tailored cover letter is ready. Edit, copy, or download. Cost: 30 💎.
Live Portfolio (No-Code Personal Brand)
Update your dashboard, and the world sees it live — no HTML, no hosting, no code. Every profile at cvifypro.vercel.app/p/username.
Professional Header
Name, headline, bio, profile picture — premium branding with shine-effect logo.
Work Experience
Timeline-style display with structured responsibilities and achievements.
Skills & Proof Tags
Categorized skills with proficiency bars and auto-generated proof badges.
Project Showcase
Cyberpunk grid with images, tech stacks, live links, and descriptions.
GitHub Integration
Live repo count, languages, and contribution stats via authenticated proxy.
Testimonials
Ratings and review quotes from colleagues or clients for social proof.
ATS Score Badge
Latest audit score displayed prominently for recruiter trust.
Contact Actions
One-click WhatsApp, Email, LinkedIn, and Resume Download buttons.
SEO & Discoverability
Every profile has dynamic OG tags, Twitter cards, and JSON-LD structured data for Google Knowledge Graph integration. Sharing on LinkedIn generates a beautiful metadata card with user's headline and image.
7 Premium Themes
CVify Classic, Midnight Dev, Corporate Gold, Creative Sunset, Slate Minimalist, Emerald Leader, and the brand-new 🕌 ORIENTAL LUXE — each with unique background animations, customizable accent colors, card styles, and interactive particle effects. All themes now support mouse-hover particle interactivity.
Document Identity (Titles)
Manage multiple tailored resumes easily. Instead of every resume being named after your full name, CVify Pro now utilizes Document Identity.
Inline Editing
Click the title in the Builder Header to rename your document instantly.
Smart Cloning
When duplicating a resume, the title automatically appends '(Copy)' to prevent naming collisions.
Future-Proof Architecture
Document Identity acts as the primary anchor for future features like Folders, Search, and Version History.
User Profile & Dashboard
Your dashboard is the command center. Every change is instantly reflected on your live portfolio. Features HUD Analytics with real-time profile views, contact clicks, and resume downloads.
Core Info
Name, headline, professional summary, location, contact details.
Experience
Multiple positions with structured bullet points. Each bullet individually editable.
Education
Degrees, certifications, institutions with date ranges.
Skills
Categorized (Technical, Soft, Tools) with percentage-based proficiency sliders.
Projects
Add/edit/delete showcase projects with images, tech stacks, and live/source links.
Clients & Testimonials
Client logos and testimonial quotes with ratings for social proof.
🤖 AI Representative (Smart Bot)
Every CVify Pro portfolio features an elite Smart AI Representative. This is not a generic chatbot — it's a deeply integrated digital twin that holds your entire portfolio in memory, answering recruiter questions instantly with 0ms latency.
Deep Client-Side NLP Engine
The bot runs a powerful Zero-Latency NLP scanner directly in the browser. It tokenizes user input, ignores stop words, and actively scans your local data (Skills, Projects, Experience, Contact, Location) to return instant factual answers without making API calls.
0ms Local Hydration
Queries like 'Does he know React?' are answered instantly by scanning the skills array locally.
Agentic Cloud Fallback
For abstract or complex conversational queries, the bot seamlessly falls back to the Groq API LLM.
Strict Formatting
The bot is programmed to avoid filler text ('Sure! Here you go...'), outputting clean markdown bullet points only.
Persistent Actions
Sticky matrix of quick-action buttons (Show Experience, View Projects, Explore Skills) remains accessible above the chat input.
Global Rate Limits & Smart Auto-Pay
To protect portfolio owners from malicious traffic spikes while maintaining a seamless visitor experience, the AI features a robust Global Daily Limit Architecture.
Global 24H Window
Limits are calculated across all visitors combined for a 24-hour window, rather than per individual visitor, preventing mass automated drains.
Smart Tiered Auto-Pay
After the initial free limit (default 5), a 2-query grace period is offered. Then, the system dynamically upgrades via Diamond tiers (15💎 for 5 queries, 20💎 for 10, etc.) up to a maximum hard cap.
Fake System Fault
When limits are fully exhausted, the AI gracefully fails by claiming a 'Server Interruption', hiding the rate limit from visitors and presenting the candidate's direct contact list.
Builder Dashboard Control
Portfolio owners can toggle Smart Auto-Pay, fixed legacy packages, or completely block AI chat directly from the new AI Settings dashboard.
Elite UI & Personalization
The 3-Layer ATS Intelligence Engine
Built on a "Layered Defense" strategy — 3 independent analysis layers that cross-validate each other for 99.99% accuracy.
Layer 1: Structural Parsing (Regex/NLP)
Server-side regex scans for section headers, date formats, contact info. Penalizes non-standard patterns that break ATS parsers.
Layer 2: NLP Keyword Engine (Compromise.js)
Extracts nouns from JD, cross-references with synonyms database. Quantification Check scans every bullet for numbers, currency, and volume metrics.
Layer 3: Generative AI Deep Audit (Gemini 2.5 Flash)
Final contextual analysis. Evaluates career-stage fit, impact quality, and provides coaching with anti-hallucination guardrails.
Hybrid Score Calibration
Final Score = AI Score × 0.6 + Server NLP Score × 0.4
This prevents AI from randomly inflating or deflating scores. Same resume = same score every time.
Dynamic Scoring Weights
All 13 Portfolio Themes
Every CVify Pro portfolio comes with 13 handcrafted, premium themes — each a complete visual identity with its own typography, color palette, card style, background animation, and interactive particle effects. All themes are powered by the new Theme Engine v4.0 — a pluggable, 5-layer architecture that auto-discovers themes at build time. All themes share the same Universal Floating Navbar for consistent navigation.
Theme Engine v4.0: Themes are lazy-loaded chunks, auto-registered via import.meta.glob, and sandbox-validated at build time. To add a new theme, run npm run create-theme <name>. No manual imports or PublicProfile.jsx edits needed. See the section for full architecture details.
CVify Classic
The original CVify signature look. Clean dark navy background with blue accent tones. Best for developers, engineers, and tech professionals who want a polished, trustworthy look.
Midnight Dev
Built for coders. Deep midnight purple background with interactive particle field that reacts to your mouse cursor in repulse mode. Animated geometric grid overlay for an immersive feel.
Corporate Gold
Authority and prestige. Dark charcoal base with warm gold accents. Diagonal stripe overlay and classic typography. Perfect for executives, finance professionals, and senior management roles.
Creative Sunset
Vibrant gradient energy. Warm orange-to-pink sunset tones with animated bokeh blobs in the background. Ideal for designers, artists, content creators, and startup founders.
Slate Minimalist
Precision in simplicity. Light gray background with barely-there noise texture. Ultra-clean typography with maximum readability. Best suited for consultants, academics, and corporate professionals.
Emerald Leader
Natural authority. Deep forest green palette exuding calm confidence and leadership. Great for sustainability professionals, project managers, and team leads.
ORIENTAL LUXE
Ultra-exotic and luxurious. Ultra-dark near-black background (#090909) with warm gold (#b58953) accents. Geometric SVG mandala patterns float behind the profile using the Outfit font. Exudes luxury, sophistication, and cultural richness.
AURA DARK
Pure darkness meets cosmic elegance. Absolute black background (#000000) with deep purple accents (#B677EF). Uses the modern Syne font for a cutting-edge aesthetic. Perfect for tech innovators, startup founders, and creators pushing boundaries.
TERMINAL DARK
The 3D Developer Portfolio aesthetic reborn inside CVify Pro. Deep midnight blue background (#050816), sleek neon purple (#915eff) accents, a glowing profile avatar in the hero, timeline experience cards, and project cards with hashtag tech stacks. Perfect for developers who want a serious, high-impact first impression.
CYBER NEON
Cutting-edge hacker aesthetic inspired by the Catppuccin design language. Near-black background (#080808) with electric neon green (#00ffcc) accents. Uses the Orbitron monospace font with glow effects on all interactive elements. Full GitHub stats integration and a sleek scrolling experience.
MONOGRAPH
CVify Pro's premier editorial theme. Stark black headers against an off-white reading canvas with brutalist borders and IBM Plex Sans typography. Designed for authors, journalists, researchers, and professionals who demand a high-contrast, typographic-first presentation that reads like a premium magazine.
NOIR
Flagship premium minimalist dark theme. Absolute black background, Satoshi typography, custom motion system, and subtle orange accents.
APEX
Clean, modern, minimal, and recruiter-focused dark aesthetic. Uses Outfit typography, electric teal highlights, and a structured, low-friction professional layout optimized for enterprise recruiters.
How to Switch Themes
Open Your Portfolio
Go to your Public Profile page (cvifypro.vercel.app/p/username).
Click Theme Editor
Tap the palette button (🎨) in the bottom-right corner — available in both light and dark mode.
Select & Apply
Click any theme card to instantly preview it live on your profile. Your selection is saved automatically.
12 Resume PDF Templates
Beyond the live digital portfolio, CVify Pro provides a world-class PDF generation engine. You can now choose from 12 distinct, ATS-optimized layout templates directly inside the Resume Builder.
Real-Time Layout Switcher
The 'Designer' tab provides a visual grid of all 12 templates. Clicking any template instantly reformats your entire resume layout without losing any content.
Intelligent Hydration
When generating the PDF or viewing a Public Link, the exact template layout you selected is perfectly preserved and applied to the render engine.
WYSIWYG Preview
What You See Is What You Get. The live preview in the builder shows exactly how the layout will respond to your content structure.
🖋️ MONOGRAPH Theme
MONOGRAPH is CVify Pro's premier editorial theme — designed for authors, journalists, researchers, and professionals who demand a high-contrast, typographic-first presentation that reads like a premium magazine.
Visual Identity
Editorial Contrast
Stark black headers (#000000) against an off-white reading canvas (#FAFAF9) provide maximum readability and a sophisticated print-like aesthetic.
IBM Plex Sans Typography
A highly legible, neo-grotesque typeface that brings a modern yet intellectual feel to every section of your portfolio.
Brutalist Borders
Sharp, high-contrast borders and dividers separate content blocks, mimicking editorial grids found in high-end publications.
Monochromatic Elegance
Zero flashy colors. Focuses entirely on content hierarchy, whitespace, and stark contrast to make your professional achievements the sole focus.
What Makes It Different
Best For
Writers & Authors
Journalists
Researchers
Academics
Legal Professionals
Editorial Designers
🌑 NOIR Theme
NOIR is CVify Pro's flagship premium dark theme. Inspired by modern minimalist developer portfolios and contemporary product design systems, it prioritizes whitespace, typography, and a calm, confident presentation.
Visual Identity & Philosophy
Absolute Minimal
Deep black background (#060606) with off-white text and subtle near-invisible gradient overlays to maintain a calm hero area.
Typography First
Utilizes Satoshi for main text and headings, paired with GeistMono for labels, numbers, and code elements.
Structured Grid
Strict 12-column desktop, 8-column tablet, and 1-column mobile layout system with consistent Y-axis spacing (96px, 80px, 64px).
Custom Motion System
Carefully designed motion with specific duration (300ms, 450ms, 700ms) and easeOut easing. Features a subtle desktop-only custom cursor.
What Makes It Different
✨ AURA DARK Theme
AURA DARK is CVify Pro's most minimalist and futuristic portfolio theme — engineered for tech professionals, startup founders, and creatives who want a distraction-free, cosmic aesthetic that lets their work speak.
Visual Identity
Absolute Black Canvas
Pure black background (#000000) creates the ultimate premium minimalism. Requires zero light compensation, perfect for late-night viewing and reduces eye strain.
Cosmic Purple Accents
Vibrant purple (#B677EF) is used for all interactive elements, links, and hover states — cosmic, electric, and unforgettable.
Syne Typeface
Modern, geometric sans-serif from Google Fonts. Sharp angles and contemporary design convey innovation, tech expertise, and forward-thinking.
GitHub Insight Panel
A dedicated GitHub Intelligence section shows live repository and contribution metrics, making your technical credibility visible on the spot.
Minimal Card Style
Ultra-clean card design with zero decoration. Borderless, shadow-free — every element is intentional and purposeful.
What Makes It Different
Best For
Tech Innovators
Startup Founders
Creative Developers
Digital Artists
Future Thinkers
Minimalist Professionals
🕌 ORIENTAL LUXE Theme
ORIENTAL LUXE is CVify Pro's most premium and culturally distinctive portfolio theme — handcrafted for professionals who want to stand out with elegance, exclusivity, and a bold visual identity.
Visual Identity
Ultra-Dark Palette
Near-black background (#090909 body, #101010 header) creates a luxurious canvas. Maximum contrast makes every element pop with premium clarity.
Gold Accent System
Warm gold (#b58953) is used for all interactive elements, highlights, and hover states — evoking prestige, heritage, and high-end branding.
Geometric SVG Backgrounds
Custom floating mandala-inspired SVG patterns are layered behind the profile content with subtle opacity, creating depth without distraction.
Outfit Typography
Uses the modern 'Outfit' Google Font — geometric, clean, and versatile. Delivers both personality and professionalism in the same typeface.
What Makes It Different
Best For
Luxury Brand Managers
Architects & Designers
Finance & Banking
Senior Executives
International Professionals
Creative Directors
💻 TERMINAL DARK Theme
TERMINAL DARK is CVify Pro's most developer-centric portfolio theme — an engineering-grade visual identity built for coders who want their portfolio to feel as polished and technical as their code.
Visual Identity
Midnight Blue Canvas
Deep #050816 background — darker than Midnight Dev, lighter than AURA DARK. Creates the perfect developer aesthetic without being overwhelmingly dark.
Neon Purple Accents
Electric purple (#915eff) powers all interactive elements — buttons, borders, glow effects, timeline dots, and hover states. High-energy and memorable.
Glowing Profile Avatar
The Hero section features the candidate's actual profile picture inside a glowing geometric container with double-rotated border frames and ambient pulse glow.
Vertical Timeline Experience
Work experience is rendered as a vertical left-border timeline with glowing purple dot markers and glassmorphic dark cards — each card hovers with a border highlight.
Hashtag Tech Stack Projects
Project cards display screenshots, descriptions, and colorful hashtag-style tech stack labels (#react, #nodejs) — familiar to any developer browsing GitHub.
Inter Typography
Clean, modern Inter font — the industry standard for developer tools and SaaS products. Ensures maximum readability for technical content.
What Makes It Different
Best For
Full-Stack Developers
Software Engineers
Open Source Contributors
CS Students
DevOps Engineers
Tech Leads
🟢 CYBER NEON Theme
CYBER NEON is CVify Pro's most visually intense portfolio theme — a pure hacker aesthetic built for professionals who want an unforgettable, electric first impression. Inspired by the Catppuccin design language and cyberpunk UI trends.
Visual Identity
Near-Black Canvas
Ultra-dark #080808 background — almost invisible seams between UI layers. Depth is created through contrast, not light, giving it a hacker terminal feel.
Electric Neon Green Accents
Vivid #00ffcc (electric cyan-green) powers all interactive elements — glowing links, hover borders, button outlines, and neon underlines on nav items.
Orbitron Monospace Font
The iconic Orbitron font (used in sci-fi interfaces, electric vehicle dashboards) gives every heading an instant techy, futuristic authority.
GitHub Stats Built-In
Full GitHub Intelligence Panel renders live repository count, top languages, and contribution activity — technical credibility baked into the theme.
Floating Dev Characters FX
Animated floating code characters (symbols, brackets, operators) drift across the background — a subtle ambient effect that keeps the page feeling alive.
What Makes It Different
Best For
Cybersecurity Experts
Blockchain Developers
Ethical Hackers
Game Developers
DevOps Engineers
Tech Creatives
🏆 APEX Theme
APEX is CVify Pro's premier recruiter-focused minimal theme. Built to capture hiring interest instantly, it incorporates a deep dark slate canvas, Outfit/Inter typography, and a signature Interactive Skills Galaxy with dual planetary orbits.
Visual Identity & Design Tokens
Clean Minimal Canvas
Deep slate background (#0D0F12) and dark card surfaces (#161920) keep visual noise to an absolute minimum.
Skills Galaxy Engine
Visualizes capabilities as orbiting spheres revolving around dynamic glowing central cores with customizable labels.
Keplerian Motion & Speeds
Planets orbit at dynamic speeds decaying with distance. Alternating directions prevent visual fatigue.
Dual Orbits Categories
Separates Technical Capabilities (Core Toolkit) and Strategic Leadership Focus areas into two stacked galaxy systems.
Key Features & Tech Specs
Best For
Senior Executives
Medical & Legal Staff
Product Managers
Software Engineers
Consultants & Directors
🎨 Theme Engine v4.0
CVify Pro's portfolio rendering system has been completely re-engineered from a monolithic PublicProfile.jsx into a pluggable, 5-layer Theme Engine — designed to scale to 1000+ themes with zero changes to core engine files. Inspired by enterprise SaaS plugin architectures.
Architecture Freeze v1.0
The 5-layer pipeline is frozen. New capabilities are added through plugins, manifests, configuration, or additive APIs — never by modifying the engine core.
The 5-Layer Pipeline
A 12-line thin shell. Only mounts ProfileLoader. Never contains theme logic, Redux selectors, or UI.
Handles all Redux dispatches, API calls (profile, analytics, GitHub), stable action callbacks, and ViewModel construction. Zero JSX beyond delegating to ProfileEngine.
Applies CSS variables to the DOM, renders universal overlays (Navbar, Resume Modal, HUD Dock, ThemePanel, AI Widget), and provides ThemeContext. Delegates theme rendering to ThemeResolver.
Looks up the theme ID in the registry, verifies engine API compatibility, lazy-loads the theme chunk, and wraps it in an ErrorBoundary to prevent crashes from taking down the engine.
A self-contained JSX component. Receives a standardized ThemeProps contract. FORBIDDEN from importing Redux, making API calls, or accessing browser storage.
ViewModel Layer
All raw DB data is normalized by profile/viewmodel/index.js before reaching any theme. This means themes are completely decoupled from the database schema — a DB field rename never breaks a theme.
12 Sub-Modules
hero.js, about.js, experience.js, education.js, skills.js, projects.js, certifications.js, testimonials.js, interests.js, contact.js, github.js, analytics.js — each independently testable.
Zero Schema Leakage
Themes receive a typed model prop instead of raw user object. DB field renames, schema changes, or data migrations never require touching theme code.
Auto-Discovery Registry
The registry uses Vite's import.meta.glob to automatically discover all theme manifests at build time. No manual imports needed.
// profile/themes/registry.js
const manifests = import.meta.glob('./*/manifest.js', { eager: true });
// ThemeResolver creates a lazy() loader for each discovered manifest
// → Adding a new theme only requires placing a folder hereShared Component Library
Primitives
Button (accent-aware), Card (glass/minimal auto-detect), Badge (accent/muted/outline), Section (semantic wrapper), Image (lazy + fallback). All read tokens from ThemeContext.
Composites
Timeline (experience/education), SkillGrid (handles both skill schemas), StatGrid (analytics), ProjectGallery (responsive grid with tech badges). Drop-in for any theme.
Theme SDK & Validation CLI
npm run create-theme <name>
Scaffolds a complete new theme folder with manifest.js, theme.config.js, tokens.js, sections.js, index.jsx, and README.md in one command.
npm run validate-themes
Runs structural checks (required files), manifest schema validation (id, engine, features, navigation), and forbidden API scans (no Redux, no fetch, no localStorage) across all themes.
Theme Sandbox Rules (Enforced)
Forbidden APIs — Violating These Crashes the Engine
useSelector / useDispatch / useStoreThemes must never access Redux directlyfetch() / axiosThemes must never make network requestslocalStorage / sessionStorageThemes must never read or write browser storageWebSocket / XMLHttpRequestNo real-time connections from theme layerimport.meta.envThemes must never read environment variables✅ Allowed: setTimeout, setInterval, requestAnimationFrame (for animations, typewriter effects, debouncing)
Bug Fixes (v4.0 Launch)
Actual Hero Vanish / Reset (React.lazy Cache)
React.lazy() was previously called inside the render function of ThemeResolver.jsx. This generated a new component reference on every single render, causing React to completely unmount and remount the entire theme DOM tree (including the Hero and TypeAnimation). Resolved by caching React.lazy() references in a static lookup cache outside the component.
Keystroke Re-Render Cascade (Local RHF)
Typing inside the contact form triggered parent state updates in ProfileLoader.jsx, rebuilding the ViewModel and re-rendering all components on every single keystroke. Fixed by refactoring the Contact components (standard & noir) to use local React Hook Form + Yup, isolating input state updates and bypassing parent-level re-renders completely.
ThemeEditor Panel Open/Close Re-Renders
Toggling the editor panel updated ProfileEngine state and rebuilt the themeProps object. Resolved by wrapping ThemeResolver in React.memo and ensuring all props and actions (e.g., stable useCallback for showResumeModal) maintain exact object identity stability.
rgba Color Input Warning Eliminated
The NOIR preset stored textSecondary as rgba(240, 240, 240, 0.7). Browser's color pickers require static #rrggbb format. Migrated all presets to static hex codes (#b0b0b0).
TypeError: Cannot read properties of undefined (reading 'name')
Legacy sub-components in Standard and CyberNeon themes expected legacy prop interfaces. Fixed by mapping and forwarding all backward-compatibility props through the themeProps contract.
Interactive Particles FX
CVify Pro portfolio themes now feature live, mouse-reactive particle animations as ambient background effects. Every particle canvas responds to visitor interaction — making your profile feel alive and truly premium.
How It Works
Repulse on Hover
When visitors move their mouse over the portfolio background, particles scatter away from the cursor in a smooth, organic repulse motion — then drift back to their positions.
Powered by tsParticles
Built with the battle-tested tsparticles (loadFull) library. Uses React's Particles component for zero-lag rendering integrated with React lifecycle.
Theme-Specific Config
Each theme has its own particle count, color, size, and speed settings tuned to match the visual mood — subtle for Corporate Gold, vivid for Midnight Dev.
Pointer-Events Enabled
The particle canvas wrapper uses pointer-events: auto so mouse events pass through to the canvas correctly. This was a key fix enabling full interactivity.
Recent Fixes & Updates
Mouse Hover Now Works
Changed the ThemeBackgroundFX wrapper from pointer-events: none → pointer-events: auto across all themes, allowing the tsParticles canvas to receive mouse events.
Switched to loadFull Engine
Replaced @tsparticles/slim with the full tsparticles package (loadFull). This provides the complete feature set including repulse, grab, and all interaction modes.
Theme Editor Visibility
The Theme Switcher button (🎨) is now visible in all color modes — previously it was invisible in light themes due to a color contrast issue. Fixed with adaptive text/border colors.
ORIENTAL LUXE Background FX
Added custom geometric SVG mandala patterns as background FX for the ORIENTAL LUXE theme, replacing the standard particle system with a unique visual language.
Particle Settings by Theme
BFF v1: High-Performance Architecture
In April 2026, we successfully transitioned CVify Pro from a fragmented API model to a Backend For Frontend (BFF) architecture. This is a senior-grade system design that prioritizes user experience above all else.
The Problem (Before v1.0)
"Previously, the dashboard had to hit 5 separate APIs (Profile, Resumes, Letters, Stats, Economy) to render a single screen. This caused 'Network Waterfalls', where if one service was slow, the whole UI felt broken or 'jiggly' due to constant layout shifts."
The Solution (BFF v1.0)
Unified v1 Endpoint
One single request (/api/v1/bff/dashboard) now returns a custom-pruned View Model containing everything your screen needs.
Heart vs Makeup Resilience
The system distinguishes between 'Heart' services (Resumes/Profile) and 'Makeup' services (Stats). If Stats fail, your dashboard still loads instantly.
SWR Strategy
Stale-While-Revalidate logic allows the UI to show cached data instantly while refreshing in the background — Zero waiting.
Section-Aware Caching
Advanced caching keys ensure that editing one resume doesn't wipe your entire dashboard cache. Only relevant segments refresh.
Performance Impact
BFF v2 — Validation Gatekeeper (July 2026)
New: Server-Side Skill Integrity Guards
The BFF now acts as a strict validation gatekeeper for technicalSkills data. A new validateTechnicalSkillsBFF() function runs inside both createResume and updateResume controllers — ensuring any raw HTTP PATCH that bypasses the React frontend is still rejected by the API.
Mutual Exclusion
A skill cannot exist in both professional lists (frontend, backend, database, aiDevOps, tools) and learningRoadmap simultaneously. Returns HTTP 400 Conflict.
Dual Format Support
Validates both nested object format { technicalSkills: { frontend: [] } } and Mongoose dot-notation { 'technicalSkills.frontend': [] } — no edge case escapes.
✅ No per-category size limit is enforced — skill lists are intentionally unlimited so users can add every keyword from a job post for maximum ATS coverage.
System Architecture
Why This Stack?
Node.js over Python
I/O-bound app (MongoDB + Gemini calls). Node's event loop handles 4x more concurrent requests than sync Python.
MongoDB over SQL
Resume = nested tree. SQL needs 10+ joins. MongoDB fetches in one query.
Tailwind 4.0
Zero-bloat. Only ships used classes. Enables Glassmorphism + Cyberpunk effects.
Redux Toolkit
Essential for draft workflows. Connection lost mid-edit? Redux keeps data predictable.
Project Structure
CVify Pro is organized as a monorepo with a clear separation between the React SPA (Client), the Express API (Server), and deployment configuration.
CVify/ ├─ Client/ # React SPA (Vite) │ ├─ scripts/ # CLI tools │ │ ├─ createTheme.cjs # Theme SDK scaffolder (npm run create-theme) │ │ └─ validateThemes.cjs # Structural validator (npm run validate-themes) │ ├─ src/ │ │ ├─ pages/ # SPA routes (Documentation, PublicProfile, …) │ │ ├─ components/ # Reusable UI (InlineEdit, ThemeEditor, …) │ │ ├─ themes/ # 8 premium theme folders (JSX components) │ │ ├─ profile/ # ✨ Theme Engine v4.0 (pluggable architecture) │ │ │ ├─ engine/ # 5-layer pipeline: Loader → Engine → Resolver │ │ │ │ ├─ ProfileLoader.jsx # Layer 2: Data, Redux, GitHub │ │ │ │ ├─ ProfileEngine.jsx # Layer 3: Overlays, ThemeContext │ │ │ │ ├─ ThemeResolver.jsx # Layer 4: Lazy-load, Error boundary │ │ │ │ ├─ ThemeContext.jsx # Design tokens shared context │ │ │ │ └─ ErrorBoundary.jsx # Theme crash isolation │ │ │ ├─ themes/ # Registry + manifest per theme │ │ │ │ ├─ registry.js # Auto-discovery (import.meta.glob) │ │ │ │ ├─ noir/ # manifest.js + theme.config.js + index.jsx │ │ │ │ ├─ auradark/ │ │ │ │ ├─ cyberneon/ │ │ │ │ ├─ monograph/ │ │ │ │ ├─ orientalluxe/ │ │ │ │ ├─ terminaldark/ │ │ │ │ ├─ standard/ │ │ │ │ └─ aurora/ # Scaffolded via create-theme SDK │ │ │ ├─ viewmodel/ # Data normalization (ViewModel layer) │ │ │ │ ├─ index.js # Root aggregator │ │ │ │ ├─ hero.js / about.js / experience.js … │ │ │ └─ shared/ # Primitives & Composites │ │ │ ├─ primitives/ # Button, Card, Badge, Section, Image │ │ │ └─ composites/ # Timeline, SkillGrid, ProjectGallery… │ │ ├─ utils/ # API wrapper, formatters │ │ └─ three/ # Three.js visualisations │ ├─ public/ # Static assets │ └─ vite.config.ts ├─ Server/ # Express API │ ├─ controllers/ # Business logic (auth, resume, ATS, …) │ ├─ models/ # Mongoose schemas │ ├─ routes/ # Express routers │ ├─ middlewares/ # Helmet, rate-limit, error handling │ ├─ services/ # Email, PDF, background jobs │ ├─ utils/ # blockedDomains.js (disposable email blocking) │ └─ server.js # Entry point, BFF integration ├─ .env # Environment variables ├─ package.json # Monorepo dependencies └─ vercel.json # Vercel deployment config
Key Directories Explained
Client/src/pages/
Every SPA route lives here — Dashboard, Builder, PublicProfile, Documentation. Each page owns its own layout and data fetching.
Client/src/themes/
8 modular theme folders (JSX components). Each is lazy-loaded by ThemeResolver via import.meta.glob auto-discovery. Adding a theme = one folder.
Client/src/profile/engine/
The 5-layer Theme Engine pipeline: ProfileLoader (data) → ProfileEngine (overlays) → ThemeResolver (lazy-load) → Theme Plugin. Engine never imports themes directly.
Client/src/profile/themes/
Registry & per-theme manifests. registry.js uses import.meta.glob to auto-discover all manifests. Each theme has manifest.js, theme.config.js, and index.jsx (re-export adapter).
Client/src/profile/viewmodel/
Normalizes raw DB data into a safe, typed ViewModel. Themes access data via model prop instead of raw user object — zero DB schema leakage into themes.
Client/scripts/
Two CLI tools: createTheme.cjs scaffolds a new theme boilerplate (npm run create-theme aurora), and validateThemes.cjs checks structure & blocks forbidden APIs.
Server/middlewares/
Helmet (security headers), express-rate-limit (abuse prevention), auth guard (JWT verification), and centralised errorHandler.js.
vercel.json
Rewrites rule: all /* routes map to the Vite build output so React Router handles client-side navigation without 404s on refresh.
Enterprise AI Gateway
The CVify Pro AI backend has officially transitioned from a monolithic controller prototype to a highly resilient, Enterprise-Grade AI Gateway. It handles traffic routing, cost optimization, and safe fallback mechanisms gracefully, ensuring 100% uptime for users.
Why We Built It
Cost & Latency Optimization
Why call an LLM when the answer is already in the database? The Gateway bypasses AI entirely for factual matches, saving $0.003 per query and returning results in 0ms.
Reliability & Graceful Degradation
LLM APIs (like Groq or Gemini) can go down. The gateway provides automatic circuit breaking — seamlessly falling back to secondary providers before the user even notices a delay.
Core Components (Platform Engineering)
1. The Decision Engine & fuse.js
Before touching the LLM, the DecisionEngine.js intercepts the request. It uses a fast regex filter followed by fuse.js (fuzzy matching) to scan the user's local projects, skills, and experience.
- If Confidence >= 85%: AI is bypassed. Static response is returned instantly.
- If Confidence >= 40%: The factual match is injected into the prompt as Absolute Ground Truth.
2. Circuit Breaker & Provider Selector
The CircuitBreaker.js tracks API health. If Groq fails 3 times, the breaker trips to OPEN state. The ProviderSelector.js then automatically routes all subsequent traffic to Gemini for 30 seconds (Cool-down period) before entering a HALF-OPEN state to test Groq again.
3. Response Validator (Streaming Interceptor)
The ResponseValidator.js intercepts the AsyncIterable stream from the LLM before it hits the frontend. It cleans up malformed Markdown on the fly (e.g. converting -Item to - Item) and detects/logs hallucinated unverified URLs.
4. Observability & Governance
The MetricsService.js tracks total requests, fallback percentages, latency, and estimated provider costs per day. The PromptVersionManager.js allows deterministic A/B testing (feature-flagging) of system prompts without database lookups using request ID hashing.
The Extreme Controller Refactor
By delegating all business logic to these micro-services, the monolithic agentController.js was reduced from 370+ lines down to a hyper-clean 44 lines. It now only handles the SSE streaming loop and passes the RequestContext to the Decision Engine.
Full Tech Stack
CVify Pro is built on a modern, production-grade stack chosen for performance, developer experience, and scalability. Every library has a deliberate justification.
🎨 Front-End (React SPA)
| Layer | Technology | Why Chosen |
|---|---|---|
| Framework | React 19 + Vite | Component-based UI, instant HMR, huge ecosystem |
| Bundler | Vite (ESBuild) | Near-zero config, sub-second cold starts |
| Routing | react-router-dom v7 | Declarative nested routes, lazy loading |
| State | Redux Toolkit | Predictable state for draft workflows, undo/redo |
| Styling | Tailwind CSS 4.0 + Custom CSS | Zero-bloat, Glassmorphism, Cyberpunk effects |
| Icons | lucide-react | Tree-shakable modern SVG icon set |
| Animations | framer-motion | Declarative physics-based animations |
| Particles | tsparticles (loadFull) | Rich particle engine, repulse/hover modes |
| 3-D | three.js + @react-three/fiber | Low-level WebGL, custom shaders |
| Forms | React Hook Form + Zod | Minimal re-renders, schema validation |
| HTTP | axios (utils/api.js) | Interceptors for auth token injection |
| SEO | react-helmet-async | Dynamic <head> tags, Open Graph, JSON-LD |
| Charts | recharts | Responsive analytics dashboard charts |
| Date | date-fns | Lightweight date formatting, no moment.js bloat |
| Alerts | sweetalert2 | Beautiful branded confirmation dialogs |
| Toasts | react-hot-toast | Lightweight, stackable toast notifications |
🛠️ Back-End (Node / Express API)
| Layer | Technology | Why Chosen |
|---|---|---|
| Runtime | Node.js 20 LTS | Modern async I/O — handles 4× concurrent requests vs sync Python |
| Framework | Express 4.x | Minimalist, middleware-centric, battle-tested |
| Database | MongoDB Atlas (Mongoose) | Flexible schema for nested resume data, one-query fetches |
| Auth | JWT (jsonwebtoken) + bcrypt | Stateless tokens, secure password storage |
| AI | Google Gemini 2.5 Flash | Context-aware audit, cover letters, intent mode |
| Nodemailer | SMTP abstraction, OTP & welcome emails | |
| PDF (server) | pdf-kit | Stream-based PDF generation |
| Cron | node-cron | Scheduled analytics aggregation & cleanup jobs |
| Rate Limit | express-rate-limit | 10 req/min auth, 30 req/min AI endpoints |
| CORS | cors | Cross-origin from Vite dev server & Vercel prod |
| Security | helmet | CSP, HSTS, X-Content-Type, X-Frame-Options headers |
| Anti-Abuse | blockedDomains.js | 200+ disposable email domains blocked on signup |
| Brute Force | LoginAttempt (MongoDB model) | Persistent Triple-Lock progressive backoff — survives serverless cold starts |
| CAPTCHA | Custom HMAC-SHA256 math challenge | Server-signed math puzzles, IP-bound, 60s expiry — zero third-party dependency |
| Bot Detection | honeypot field (type=hidden) | Silent bot trap in login form — server rejects any request with it filled |
| Fingerprinting | deviceFingerprint.middleware.js | SHA-256 device ID from UA+IP+Headers — new device triggers alert email |
| Travel Guard | impossibleTravel.middleware.js | Flags logins 1000+ km apart in under 3 hours as impossible travel |
| IP Reputation | ipReputation.middleware.js | Checks IP against known bad actor ranges before processing |
| Key Derivation | crypto.createHmac (Node built-in) | HMAC-SHA256 derives purpose-scoped secrets from JWT_SECRET — no hardcoded strings |
| Logging | morgan + winston | HTTP access logs + structured app-level logs |
| Env | dotenv | Safe .env loading, never committed to git |
| Error | errorHandler.js | Centralised error responses, status codes |
Helmet Middleware
Helmet is a collection of 14 Express middleware functions that set security-related HTTP response headers — the industry-standard first line of defence for any Node.js API.
How It's Integrated
Helmet is registered globally in Server/server.js — before any route is mounted. This ensures every response, regardless of endpoint, carries the security headers.
// Server/server.js import helmet from 'helmet'; app.use(helmet()); // Global — applied to ALL routes
HTTP Headers Helmet Enables
Content-Security-Policy (CSP)
Restricts which scripts, styles, and sources the browser will load. Prevents XSS injection attacks that could steal user sessions or diamonds.
Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS exclusively for 1 year. Prevents SSL-stripping man-in-the-middle attacks.
X-Content-Type-Options
Prevents browsers from MIME-sniffing a response. Stops attackers from tricking browsers into treating text as scripts.
X-Frame-Options
Blocks embedding CVify Pro in iframes. Prevents clickjacking attacks where users think they're clicking our UI but are really interacting with a malicious overlay.
Referrer-Policy
Controls how much referrer info is sent with requests. Protects user privacy when navigating from CVify Pro to external links.
Permissions-Policy
Disables powerful browser features (camera, microphone, geolocation) that CVify Pro doesn't use — reducing attack surface.
Why Helmet vs Manual Header Setting?
Manually writing res.setHeader() for every security header is error-prone and easy to forget. Helmet encapsulates 14 best-practice headers in a single app.use(helmet()) call — ensuring no header is accidentally omitted and keeping the codebase maintainable.
Disposable Email Blocking
To prevent platform abuse, bot registrations, and referral fraud, CVify Pro maintains a curated block-list of 200+ disposable and temporary email service domains — validated on both the client and server.
The Problem It Solves
Fake Signups
Services like Mailinator, Guerrilla Mail, and 10MinuteMail let anyone create a disposable inbox in seconds. Without blocking, bots can mass-register accounts to abuse the free diamond system.
Referral Fraud
The diamond referral system rewards users for inviting colleagues. Disposable emails allow a single actor to create hundreds of fake accounts and farm diamonds dishonestly.
Technical Implementation
Server-Side (Primary Guard)
Located at Server/utils/blockedDomains.js. Exports an isDisposableEmail(email) function that checks the email domain against a JavaScript Set for O(1) lookup speed.
// Server/utils/blockedDomains.js
const blockedDomains = new Set([
"mailinator.com", "guerrillamail.com",
"10minutemail.com", /* 200+ more */
]);
export const isDisposableEmail = (email) => {
const domain = email.split('@')[1]?.toLowerCase();
return blockedDomains.has(domain);
};Client-Side (Immediate Feedback)
The same domain list is mirrored on the frontend for instant validation — the user sees an error before the form is even submitted, saving a round-trip to the server and improving UX.
Where It's Called
isDisposableEmail() is invoked in the Auth Controller (on registration) and the Referral Service (on referral claim) — the two most abuse-prone entry points.
Domain Sources
Families Covered
Mailinator Family
Guerrilla Mail
10MinuteMail
Temp-Mail
YOPmail
Trashmail
Sharklasers
Spamgourmet
Dispostable
ThrowAM
AirMail
Nada Email
Security, Compliance & Privacy
bcrypt + Pepper Hashing
Passwords are hashed with bcrypt (cost 10) combined with a server-side PEPPER_KEY. Even if the database is breached, hashes cannot be cracked without the secret pepper.
JWT + HttpOnly Cookies
Signed, verified tokens issued as HttpOnly, Secure, SameSite=Lax cookies. Prevents XSS-based session theft. Fallback to Bearer header for backward compatibility.
Data Encryption
Encrypted at rest in MongoDB Atlas. AI processing via Gemini over encrypted HTTPS. Zero retention for training.
File Security
Resume uploads processed in memory (multer) — never stored on disk. Instant processing, immediate disposal.
🔐 Security v6.0 — Defense in Depth
In June 2026, CVify Pro underwent a comprehensive multi-layer security hardening following a surgical refactor approach. All changes are backward-compatible — existing users and sessions were not disrupted.
1. Rate Limiting (Auth Routes)
A unified authLimiter is applied strictly to /login, /signup, /forgot-password, and /reset-password.
2. NoSQL Injection Protection
express-mongo-sanitize is registered globally immediately after express.json(). It strips Mongo operators ($where, $gt, etc.) from all request bodies, queries, and params before they reach any controller.
3. Password Validation Hardening
All password validation across signup, changePassword, resetPassword, and updateProfile now enforces a unified standard:
Min 8 characters, Max 72 characters. The 72-char cap mitigates bcrypt-based ReDoS attacks.
4. Pepper Hashing + Lazy Migration
Server-Side Pepper
A cryptographically random 32-byte PEPPER_KEY is stored only on the server (.env / Vercel Env Vars) — never in the database. Passwords are hashed as bcrypt(password + pepper, 10).
Lazy Migration (Zero User Disruption)
On login, the system first tries the peppered hash. If it fails, it tries the legacy hash. If legacy succeeds, the password is silently re-hashed with pepper in the background. No user is locked out.
Migration Flow
Login Attempt ├─ bcrypt(password + PEPPER_KEY) → ✅ Match → Login ├─ bcrypt(password + PEPPER_KEY) → ❌ Fail │ └─ bcrypt(password) → ✅ Legacy Match │ └─ Re-hash with pepper → Save → Login (seamless) └─ Both fail → 401 Unauthorized
5. HttpOnly Cookie Auth
JWT tokens are no longer stored in localStorage. On successful login or OTP verification, the server issues an HttpOnly cookie:
6. Secure Logout Endpoint
A new POST /api/auth/logout endpoint clears the authToken cookie server-side by setting it to an expired value. The Redux logout() action silently calls this endpoint as a fire-and-forget operation — no UI changes required.
7. Frontend Axios Alignment
withCredentials: true
The global Axios instance now sends withCredentials: true on every request, ensuring the HttpOnly authToken cookie is automatically forwarded to the backend.
localStorage Token Removed
Only the JWT token was removed from localStorage. User profile data (Full name, Email, Location) persists unchanged. Redux state structure { user, token, isAuthenticated } is intact.
Security Checklist
🌐 Network Resiliency & Offline UI
CVify Pro includes a global, real-time Network Status Monitor (NetworkStatus.jsx) mounted at the root level in App.jsx. It provides instant visual feedback when a candidate loses internet connectivity or experiences high latency.
1. No Internet (Offline) Overlay
Automatic Connection Interception
Triggers on window "offline" event
When internet connection drops, a glassmorphic top banner slides in with a pulsating alert: "You are currently offline. Changes will sync automatically once reconnected." Includes an instant manual retry button.
✅ Auto-Recovery Toast
When connection restores, a green "Internet Restored!" confirmation appears for 4 seconds before auto-dismissing.
2. Low / Slow Internet (2G & High Latency Alert)
Dual Detection Engine
Network Information API + Lightweight Health Ping
Monitors navigator.connection.effectiveType ("2g", "slow-2g", RTT > 1500ms) alongside background periodic HEAD latency checks. If network speed degrades, a bottom-right amber toast warns the user: "Slow Network Detected — AI operations & imports may take longer."
Testing in Chrome DevTools
🛡️ Security v7.0 — Triple-Lock Architecture & Threat Model
In July 2026, CVify Pro underwent the most comprehensive authentication security hardening in its history. The primary motivation was a red-team analysis that exposed 4 realistic brute-force bypass scenarios in the previous single-layer rate limiter. All changes are production-deployed, backward-compatible, and aligned with enterprise SOC standards.
1. Threat Model & Trust Boundaries
CVify Pro enforces zero-trust data validation at every network boundary to protect critical user assets and session artifacts.
Assets Protected
Trust Boundaries
Browser (Untrusted Client)
│
▼ [TLS 1.3 / Encrypted Transit]
Cloudflare WAF (DDoS / Edge Filtering)
│
▼ [Origin Cloaked]
Vercel Serverless Edge Gateway
│
▼ [Isolated Process]
Express API Engine (BFF)
│
▼ [TLS / Connection Pool]
MongoDB Atlas (Encrypted Database)Each boundary enforces strict sanitization, origin checks, and cryptographic token verification.
2. End-to-End Request Security Pipeline
Every incoming authentication request traverses 10 distinct security checkpoints before reaching controller logic.
[ Incoming HTTP Request ]
│
▼
1. Cloudflare WAF ───────────► [ Drop Layer 7 DDoS & Malicious Scrapers ]
│
▼
2. Vercel Serverless Edge ───► [ Enforce SSL/TLS 1.3 & HSTS ]
│
▼
3. Helmet Headers ───────────► [ Inject CSP, X-Frame-Options, Referrer-Policy ]
│
▼
4. Rate Limiter ─────────────► [ IP+Email Bucket Check (express-rate-limit) ]
│
▼
5. IP Reputation Guard ──────► [ Block Malicious Proxy & Known VPN Ranges ]
│
▼
6. Honeypot Validation ──────► [ Check Hidden Input _honey (Bot Trap) ]
│
▼
7. Triple-Lock Engine ───────► [ Parallel Lookup: Combo, Email, IP in MongoDB ]
│
▼
8. Custom CAPTCHA ───────────► [ Validate HMAC-SHA256 Signed Math Challenge ]
│
▼
9. JWT / Cookie Auth ────────► [ Verify HttpOnly Token & Session Integrity ]
│
▼
10. Controller Execution ───► [ Process Request & Log HMAC Integrity Chain ]
│
▼
[ Secure Response Sent ]3. The 4 Bypass Scenarios Solved in v7.0
Distributed IP Rotation
Problem
Attacker rotates 1,000 proxy IPs targeting 1 email. Per-IP limiter triggers at 10 — but with 1,000 IPs they get 10,000 attempts before any single IP is blocked.
Fix Applied
Email Lock: SHA256(email) independently tracks all attempts per target email regardless of source IP.
Password Spraying
Problem
Attacker picks 1 common password and tries it against 10,000 different emails from 1 IP. Per-email limiter never triggers since each email only sees 1 attempt.
Fix Applied
IP Lock: SHA256(ip) tracks total failed attempts per source IP across ALL emails — triggers after 30 attempts.
Serverless Memory Reset
Problem
Vercel cold starts reset in-memory rate limit counters. Attacker waits for function cold start then gets fresh attempt budget.
Fix Applied
All three locks stored in MongoDB — survives cold starts, shared across all serverless instances globally.
Combo Attack (Credential Stuffing)
Problem
Attacker uses leaked email:password pairs from data breaches, trying each combo from a unique IP. Single-dimension locks (IP-only or Email-only) miss this pattern.
Fix Applied
Combo Lock: SHA256(email:ip) locks the specific email+IP pair after 5 attempts — catches credential stuffing without impacting other users on the same IP.
4. Triple-Lock Architecture & Per-Lock Thresholds
Three independent SHA-256 hashed identifiers are computed on every login attempt and evaluated with progressive thresholds.
| Lock Type | CAPTCHA Triggers At | Hard Lock At | Rationale |
|---|---|---|---|
| Combo SHA256(email:ip) | 5 attempts | 6 attempts | Single account targeted from one device — strictest |
| Email SHA256(email) | 5 attempts | 6 attempts | Same account targeted from rotating IPs — strict |
| IP SHA256(ip) | 30 attempts | 50 attempts | Lenient — prevents false-positive blocking of multi-account users on same IP (home, office) |
5. Enterprise Security Headers Matrix
Configured globally via Helmet middleware to enforce browser-level security policies.
| Header | Purpose & Defense | Status |
|---|---|---|
| Strict-Transport-Security (HSTS) | Enforces HTTPS connections for 2 years (includeSubDomains, preload). Prevents SSL stripping. | ✔ Active |
| Content-Security-Policy (CSP) | Restricts script execution to whitelisted origins. Prevents XSS & data exfiltration. | ✔ Active |
| Permissions-Policy | Disables camera, microphone, geolocation, and payment APIs for application pages. | ✔ Active |
| Referrer-Policy | Sets strict-origin-when-cross-origin to prevent leaking URL parameters to 3rd parties. | ✔ Active |
| X-Frame-Options | Set to DENY — prevents Clickjacking attacks by disallowing iframe embedding. | ✔ Active |
| Cross-Origin-Opener-Policy (COOP) | Set to same-origin — isolates browsing context from cross-origin popup windows. | ✔ Active |
| Cross-Origin-Resource-Policy (CORP) | Set to same-site — prevents unauthorized cross-origin reading of static assets. | ✔ Active |
6. OWASP Cryptographic Primitive Inventory
Mapped against OWASP ASVS v4.0 (Section 6: Stored Cryptography) and NIST SP 800-63B standards.
| Purpose | Algorithm | Key Source | Rotation |
|---|---|---|---|
| Password Storage | bcrypt (Cost 10) + Pepper | PEPPER_KEY env var | Lazy Migration |
| JWT Tokens | HMAC-SHA256 (HS256) | JWT_SECRET root | 90 Days (kid v1/v2) |
| Math CAPTCHA | HMAC-SHA256 | Derived Purpose Key | 60s Per-Challenge |
| Admin Audit Log | HMAC-SHA256 Chain | Derived Purpose Key | Domain Separated |
| Device Fingerprint | SHA-256 | UA+IP+Platform Hash | Statistically Static |
| Triple-Lock Brute Force | SHA-256 Hashed Keys | MongoDB Index Keys | Ephemeral (24h TTL) |
| Refresh Tokens (v8.0) | SHA-256(token) Hash | CSPRNG 256-bit Token | Rotated on Issue |
7. v8.0 10-Step Sequential Execution Roadmap
Strict engineering sequence aligned with OWASP Cryptographic Storage Cheat Sheet and NIST recommendations:
Refresh Token Rotation (RTR)
Automatic token family revocation on reuse detection.
Refresh Token Hashing
Store SHA256(token) in MongoDB instead of plain tokens.
Active Session Dashboard
View & terminate active device sessions remotely.
Google OAuth 2.0 PKCE
Enterprise social login with PKCE verification.
WebAuthn / Passkeys
Biometric & hardware key support (Touch ID, YubiKey).
Key Versioning (`kid`)
Header support for kid: 'v1' / 'v2' zero-downtime key rotation.
Automatic Key Rotation
Automated 90-day JWT secret rotation policy.
Crypto Inventory Living Artifact
crypto_inventory.md for SOC 2 / ISO 27001 readiness.
SIEM Operations Dashboard
Real-time threat telemetry stream for SOC teams.
Zero-Trust Continuous Auth
Adaptive step-up authentication on sensitive actions.
7. 7 Bugs Found & Fixed During v7.0 Refactor
CAPTCHA SHA-256 Key Mismatch (403 Loop)
Root Cause
POST /captcha/verify body had no email field. getAttemptIdentifier(req) computed SHA256('email:') — empty string. captchaSolved=true was written to wrong DB records. Login saw captchaSolved=false on real records → infinite 403.
Fix Applied
verifyCaptcha now accepts email in body. Manually computes SHA256(email:ip) using the same formula as login. Correct records updated.
captchaSolved Reset on Wrong Password
Root Cause
recordFailedAttempt() had captchaSolved = false on every failed attempt ≥ threshold 5. User solves CAPTCHA → types wrong password → captchaSolved wiped → CAPTCHA demanded again. Infinite loop.
Fix Applied
Guard added: if (!record.captchaSolved) record.captchaSolved = false — preserves solved state. User can retry password without re-solving.
Honeypot Autofill (400 False Positives)
Root Cause
Honeypot field was type='text' with CSS display:none. Chrome, Bitwarden, and LastPass autofill ALL text inputs in login forms — even CSS-hidden ones. Server saw _honey filled → 400 'bot detected' for real users.
Fix Applied
Changed to type='hidden'. Password managers never fill type=hidden inputs. 0 false positives since fix.
IP False-Positive (Multi-Account Same IP)
Root Cause
All three locks shared CAPTCHA threshold=5 / lock=6. Developer testing 2 accounts in different browsers: Browser 1 hits 6 failed attempts → ipKey at 6 → Browser 2's first attempt on different account immediately blocked.
Fix Applied
Separated IP thresholds: 30 CAPTCHA, 50 hard lock. Legitimate multi-account users on same IP unaffected. True password spraying (50+ accounts) still caught.
Vercel 500 Crash (Startup Secret Throw)
Root Cause
security.js and captcha.middleware.js threw new Error() at module load time if ADMIN_LOG_SECRET or CAPTCHA_SECRET env vars were missing. Vercel serverless warm-start loaded these modules, found missing env vars, and crashed the entire function → GET /api/auth/me returned 500.
Fix Applied
Replaced throw with HMAC key derivation: crypto.createHmac('sha256', JWT_SECRET).update('purpose_v1').digest('hex'). Server never crashes — unique purpose-scoped key derived at runtime.
Hardcoded Fallback Secret
Root Cause
Previous fix used || 'cvify_default_admin_log_secret_2026' as fallback. Any deployment missing env vars would silently use this known string — identical across all deployments. JWT_SECRET reuse also violated principle of least privilege.
Fix Applied
Pure HMAC derivation from JWT_SECRET with domain-separated purposes: 'admin_log_integrity_v1' and 'captcha_signing_v1'. No static strings. Each purpose gets a cryptographically unique key.
Session Expired Modal on Wrong Credentials
Root Cause
Axios interceptor treated ALL 401 responses as SESSION_EXPIRED. POST /auth/login returning 401 (wrong password) triggered 'Session Expired' modal — forcing page reload. Login form state, typed credentials, and countdown timer were destroyed.
Fix Applied
Interceptor now distinguishes endpoints: auth routes (login, signup, captcha) get inline error handling only. Session Expired modal fires ONLY on 401s from authenticated API calls (/api/user, /api/resumes, etc.).
8. Security v7.0 — FAQ
QWhy MongoDB instead of Redis for storing login attempts?
CVify Pro is deployed on Vercel's serverless platform. Redis requires a persistent TCP connection which serverless functions cannot maintain across invocations. MongoDB Atlas handles connection pooling via mongoose and survives cold starts. The performance difference is negligible at CVify's scale — LoginAttempt documents have compound indexes and expire automatically via TTL (24h) for self-cleaning.
QIf the IP threshold is 30, can an attacker still do 30 password attempts per account?
No. The Combo lock (SHA256(email:ip)) triggers at 5 attempts for the specific email+IP pair. The IP lock (SHA256(ip)) at 30 is for cross-account spraying detection only. An attacker gets 5 attempts per email per IP before the Combo lock fires — same as the v6.0 behavior for any specific account.
QWhy build a custom CAPTCHA instead of using Google reCAPTCHA?
Three reasons: (1) Privacy — reCAPTCHA sends user behavioral data to Google servers. (2) Zero dependency cost — no API keys, no billing, no rate limits. (3) Simplicity — arithmetic CAPTCHAs are sufficient to block automated scripts. Real humans solve '14 + 7' in under 3 seconds. The HMAC-SHA256 token prevents the answer from being computed client-side, and IP-binding prevents solve-and-replay attacks.
QCan an attacker bypass the brute force protection by clearing cookies or local storage?
No. All security state is stored exclusively in MongoDB — not in cookies, localStorage, or sessionStorage. Clearing browser storage has zero effect. The server recomputes SHA-256 keys from the request email and IP on every attempt and looks up the current attempt count in the database. The only way to bypass the lock is to change email address AND IP address simultaneously — which the Combo lock handles by tracking both.
QWhat happens to my CAPTCHA solve if I accidentally close the browser tab during the security delay?
Your CAPTCHA solved status is stored in MongoDB, not in browser state. When you return to the login page, the frontend calls POST /api/auth/security-state which reads from MongoDB and returns your current lock status including captchaSolved=true. The UI restores the 'CAPTCHA Verified' badge and the countdown timer resumes from the correct remaining time — not from scratch.
📱 Device Fingerprinting & Security Alert Email System
CVify Pro automatically detects logins from un-recognized devices and issues immediate, geo-located, timezone-aware security alert notifications. The system operates silently without blocking user workflows, maintaining a 10-device rolling history per account in MongoDB.
1. Device Detection & Alert Pipeline
Every successful login triggers background fingerprint analysis and geo-resolution.
[ User Authenticates (POST /api/auth/login) ]
│
▼
┌───────────────────────────────────────────────┐
│ 1. Extract Headers: UA, Lang, Encoding, IP │
│ 2. Parse User-Agent: Browser & OS Name/Version│
│ 3. GeoIP Lookup: Country ISO & IANA Timezone │
└───────────────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────────────┐
│ SHA-256 Hash -> 32-char Device Fingerprint │
└───────────────────────┬───────────────────────┘
│
▼
[ Match user.knownDevices Array ]
│
┌────────────────┴────────────────┐
▼ ▼
[ Known Device ] [ NEW DEVICE DETECTED ]
Update lastSeen timestamp ├── Push to knownDevices (Max 10)
└── Trigger sendNewDeviceAlertEmail()
│
▼
┌───────────────────────────────┐
│ Dark HTML Security Template │
│ • Full Country Name │
│ • Local Time (IANA + UTC Off) │
│ • Monospace IP & Browser Info │
│ • /profile Security Link CTA │
└───────────────────────────────┘2. Key Engine Capabilities
SHA-256 Lightweight Fingerprinting
Generates a deterministic 32-character hash from User-Agent, language, encoding, platform, and country. Avoids invasive client scripts while providing fast anomaly detection.
ISO → Full Country Name Resolution
Maps raw ISO-3166-1 alpha-2 country codes (e.g. PK, US, GB) to human-readable names (Pakistan, United States, United Kingdom) using a zero-dependency server lookup table.
IANA Timezone Localization
Resolves IP to IANA Timezone (geo.timezone e.g. Asia/Karachi) and formats local login timestamps with UTC offset (e.g. August 11, 2026, 8:43 PM (Asia/Karachi, UTC+05:00)).
Non-Blocking Fire-and-Forget Dispatch
Alert emails run asynchronously post-login. Email service latency or delivery failures never delay or crash the primary authentication flow.
3. Dark Security Alert Email Specifications
Redesigned to match CVify Pro's dark ecosystem design system (#060608 canvas, #121218 card, #1e1e2c borders).
| Component | Design & Payload Specification | Security / UX Rationale |
|---|---|---|
| Header | CVifyPro Logo + 'Security Operations Center' subtitle | Establishes immediate brand trust and authority |
| Alert Banner | Linear gradient (#1a0a0a → #1a1218) with red pill badge '⚠ SECURITY ALERT' | Visual urgency signal before user reads text |
| Session Details | Browser, OS, Full Country Name, Monospace Teal IP, Local Time (IANA + Offset) | Precise diagnostic data for account owner verification |
| Action Blocks | Green '✓ This was you?' (Ignore) / Red '⚠ Not you?' (Password change) | Dual-choice UI eliminates ambiguity for non-technical users |
| CTA Button | Solid Red (#ef4444) 'Secure My Account' pointing to /profile | Direct navigation to profile security settings |
| Footer | CVify Pro branding + DataVerse attribution + Automated email warning | Compliance with anti-phishing email standards |
4. Device Storage & Performance Limits
Rolling Device Cap (10 Max)
To prevent un-bounded document growth in MongoDB, user.knownDevices is sliced to retain only the 10 most recent devices:if (user.knownDevices.length > 10) user.knownDevices = user.knownDevices.slice(-10);
Known Device Touch Handling
When a login matches an existing fingerprint in user.knownDevices, no email alert is dispatched. The engine simply updates the lastSeen timestamp for that device in MongoDB.
The Diamond Economy 💎
Diamonds power CVify Pro's AI features. We charge post-success only — you're never billed for failed requests. Atomic operations ensure integrity.
Earn diamonds by referring colleagues, community contributions, or during promotional events. Premium packages coming soon.
Why Choose CVify Pro?
Let's Be Real
Giants like LinkedIn, Indeed, Canva, Zety, Jobscan, and Rezi exist — they're reliable, credible, trustworthy, and backed by billions. We respect them. They've shaped the industry. So why should you choose us?
"Giant platforms sell you a Template. CVify Pro sells you Verifiable Proof and AI-driven Mentorship."
Because the giants solve one piece of the puzzle. LinkedIn is a network, not an ATS auditor. Canva makes pretty resumes that fail ATS parsing (75% rejection before human eyes). Jobscan matches keywords but doesn't know if you're a fresher or a senior. No single platform combines all of these — except CVify Pro.
Why Job Seekers Choose Us
Your Resume Gets UNDERSTOOD
We don't just count keywords. Our 3-Layer Engine understands context — a fresher missing AWS gets encouragement, a senior gets a critical alert. No other tool does this.
You See What Recruiters See
6-Second Recruiter Impression, strong bullet highlights, and exact before→after rewrites. You don't guess what's wrong — you KNOW and you get the fix.
No Lies, No Inflation
Our Anti-Hallucination Engine has 6 strict rules. Every feedback quotes YOUR actual resume. If your score is 45, we say 45 — then we show you HOW to make it 85.
Complete Career Ecosystem
ATS Scanner + AI Cover Letters + Live Portfolio + GitHub Integration + SEO + Theme Customization — all in one place. No switching between 5 different tools.
Empathy-First Coaching
We highlight your STRENGTHS first, then suggest improvements with rewritten examples. You'll never feel crushed — you'll feel guided, like having a personal career coach.
Globally Inclusive
Optimized for English, Urdu, and Dutch. Market-specific scoring for Pakistani HR, European Remote, Freelance, and Standard modes. Not western-centric — built for the world.
Why Recruiters Trust Us
Proof-Based Candidates
Skills aren't just text — they're backed by live GitHub repos, project counts, and ATS audit scores. You see PROOF, not promises.
Pre-Screened Resumes
Candidates who use CVify Pro have already passed a 3-layer AI audit and optimized for YOUR JD. Less screening time, better matches.
Transparent Scoring
Every score comes with a justification. You know WHY a candidate scored 85 in keywords and 60 in quantification — no black boxes.
One-Click Discovery
10 seconds: repos, projects, ATS score, experience timeline, contact buttons — all on one HUD dashboard. No PDF downloading needed.
What We Do That NOBODY Else Does
Context-Aware Scoring
Only platform that scores differently for a fresher vs senior. A 22-year-old missing Docker is okay. A 35-year-old missing Docker is a red flag.
Hybrid Score Calibration
AI Score × 0.6 + Server NLP × 0.4. When AI tries to inflate your score, the server catches it. When AI lowballs, the server corrects. Mathematical honesty.
Before → After Bullet Rewrites
Not just 'fix this' — we rewrite your weakest line using the Google XYZ formula and tell you exactly WHERE to paste it in your resume.
Universal Professional Agency
Teacher, banker, receptionist, CEO — the AI adapts for ALL professions. Not just tech. Not just white-collar. Everyone.
Live SEO-Optimized Portfolio
Your profile appears on Google with JSON-LD structured data. Share on LinkedIn and it auto-generates a rich preview card. No coding, no hosting.
Feature-by-Feature Comparison
| Feature | CVify Pro | Canva / Zety | Rezi / Jobscan |
|---|---|---|---|
| ATS Intelligence | v4.0 Precision Engine | ❌ None / Basic | ✅ Basic Matching |
| Context-Aware Scoring | ✅ Fresher → Senior | ❌ No | ❌ No |
| Anti-Hallucination | ✅ 6 Strict Rules | ❌ No | ❌ No |
| Hybrid Calibration | ✅ AI × 0.6 + NLP × 0.4 | ❌ No | ❌ No |
| Live Web Portfolio | ✅ SEO + JSON-LD | ❌ No | ❌ No |
| AI Cover Letters | ✅ 3 Personality Styles | ✅ Basic | ✅ Basic |
| GitHub Integration | ✅ Live Repos + Stats | ❌ No | ❌ No |
| Recruiter Impression | ✅ 6-Second Verdict | ❌ No | ❌ No |
| Before→After Bullets | ✅ AI Rewrite + Tips | ❌ No | ❌ No |
| Universal Agency | ✅ Peon to CEO | ❌ Tech Only | ❌ Tech Only |
| Score Justification | ✅ WHY per metric | ❌ No | ❌ No |
| Resume Coaching Tone | ✅ Empathetic + Strict | ❌ N/A | ❌ Generic |
| Recruiter Trust | ✅ API-Verified Proof | ❌ Self-Reported Only | ❌ Self-Reported Only |
| Digital Presence | ✅ Live SEO Web Profile | ❌ Dead PDF Only | ❌ Dead PDF Only |
| Global / Local Markets | ✅ EN, UR, NL + 4 Modes | ❌ Western Only | ❌ Western Only |
The Bottom Line
Giants build platforms. We build precision. They give you templates — we give you intelligence. They count keywords — we understand careers. If you want a pretty PDF, use Canva. If you want to actually get hired, use CVify Pro.
Giants are reliable. CVify Pro is reliable AND empathetic, context-aware, proof-based, recruiter-ready, and globally inclusive.
For Recruiters & HR Teams
CVify Pro ensures candidates are "Recruiter-Ready" from the first click. Recruiters spend 6 seconds on a resume — we make those 6 seconds count.
Verified Skills
Skills backed by live project data and GitHub metrics. No more guessing.
ATS-Friendly Output
Standard formats your ATS loves — guaranteed 95%+ parse rate.
Contextual Fit
Candidates AI-match their history against your JD, saving screening time.
10-Second Discovery
Repos, Projects, ATS Score, Contact — all in one HUD dashboard.
Psychological Conversion Triggers
Trust signals (verified ATS badges), proof tags (auto-generated "Top Rated" labels), and low-friction contact (one-click WhatsApp/Email/Download) convert profile visitors into interview schedulers.
Built for Everyone (Peon to CEO)
CVify Pro is NOT just for developers. We've democratized elite career branding for every professional level and field.
Tech Professionals
Full GitHub integration, tech-stack optimization, project-based scoring.
Corporate Leaders
Leadership-focused scoring with quantified business impact.
Service Industry
Teachers, Receptionists — AI focuses on tenure, responsibilities, soft skills.
Creatives & Graduates
Portfolio-first approach. Fresh grads get academic project emphasis.
Pro Tips for a 90+ ATS Score
Quantify Everything
Replace 'Managed a team' with 'Led 8 engineers, delivering 3 projects 15% under budget.'
Google XYZ Formula
'Accomplished [X] as measured by [Y], by doing [Z].' How Google engineers write resumes.
Mirror JD Language
If JD says 'Docker containerization,' don't write 'used containers.' Exact match wins.
Standard Headers
Work Experience, Education, Skills, Projects. Creative headers confuse parsers.
Keywords in Context
Don't list keywords at bottom. Integrate into project descriptions and bullets.
PDF vs DOCX
Both supported. PDF preserves layout. DOCX preferred by some enterprise ATS.
Frequently Asked Questions
Q: My ATS score is low. What should I do?
A: Read "Missing Keywords" — each has exact placement strategy. Then check "Weak Bullets" for before/after improvements you can copy-paste.
Q: Is my data safe?
A: Bank-grade security: bcrypt (cost 10) + server-side pepper hashing, JWT + HttpOnly cookies (XSS-safe), encrypted HTTPS, and triple-lock brute force protection. Zero AI training data retention.
Q: Can I use this for non-tech jobs?
A: Yes! Works for teachers, bankers, receptionists, marketers — anyone. AI adapts to your field automatically.
Q: Why does the scan cost diamonds?
A: Each scan uses Gemini 2.5 Flash with 3-layer analysis. Diamonds ensure fair usage and platform sustainability.
Q: Can recruiters see my portfolio?
A: Yes — cvifypro.vercel.app/p/username is public. You control visibility through dashboard settings.
Q: How is this different from Canva/Zety/Rezi?
A: Only platform combining AI ATS Auditor + Context-Aware Scoring + Live Portfolio + Cover Letter AI + Recruiter HUD — all in one ecosystem.
Q: What file formats are supported?
A: PDF or DOCX (max 5MB). PDF recommended for layout consistency.
Q: Do I need technical knowledge?
A: Zero. Step-by-step career coach. Portfolio auto-generated from profile data.
Q: Can I add skills I'm still learning but not yet expert in?
A: Yes — that's exactly what the 'Currently Learning' section is for. Add skills like Docker or AWS to your Learning Roadmap. They appear with a distinct amber badge so recruiters understand your honest growth trajectory, not inflated claims.
Q: Will 'Currently Learning' skills hurt my ATS score?
A: No — they help at a discounted weight. ATS Scanner matches learningRoadmap keywords at 50% weight (vs 100% for professional skills). You get partial credit for gaps-in-progress, never a penalty. A matched learning skill also earns a 'Gap Bridged' tag on recruiter scorecards.
Q: Can I add the same skill to both professional skills and Currently Learning?
A: No — and the system enforces this strictly. If a skill exists in your professional lists (Frontend, Backend, etc.), it cannot also appear in Currently Learning. This rule is enforced in the React UI and also at the API (server) level, so it cannot be bypassed.
Future Roadmap
Recently Released (Live Now! 🚀)
🧠 Currently Learning Skills (learningRoadmap)
New technicalSkills.learningRoadmap field added to the Resume schema. Users can tag skills they are actively studying — displayed with distinct amber 'Learning' styling in the Skills section. Full architecture: useResumeSkills() hook decouples UI from Redux paths, BFF validateTechnicalSkillsBFF() enforces mutual exclusion at API level, and ATS scoring applies a 50% weight to learning skills to prevent dishonest scorecards.
BFF Validation Gatekeeper v2 — technicalSkills Integrity
A production-grade validateTechnicalSkillsBFF() function now runs inside both createResume and updateResume server controllers. Enforces: (1) Mutual exclusion — same skill cannot be in professional lists AND learningRoadmap simultaneously, (2) Dual-format support for both nested object and Mongoose dot-notation PATCH bodies. Skill lists are intentionally unlimited — no size cap. Returns HTTP 400 with a precise conflict message.
Redux resumeSlice Architecture Refactor
Removed the ResumeFields constants dictionary (Single Responsibility principle — Redux slice should not own domain schema). The setResumeField reducer now uses a generic nested-path resolver supporting dot-notation like 'technicalSkills.learningRoadmap' — eliminating 29 hardcoded constants while maintaining full backward compatibility.
Universal Floating Navbar — All Themes
The premium pill-shaped floating navbar (previously only on Standard themes) is now the single universal navbar across ALL 13 themes. AuraDark and CyberNeon's old theme-specific navbars were removed and replaced. Navbar links dynamically map to the correct section IDs per theme.
DataVerse Technologies Footer Branding
A consistent branded footer has been added across all 13 portfolio themes: 'Powered by DataVerse Technologies | Designed & Developed by Umair Ahmed | © 2026'. Both DataVerse and Umair Ahmed link to their respective public profiles.
CYBER NEON Theme
10th premium portfolio theme — near-black (#080808) background with electric neon green (#00ffcc) accents, Orbitron monospace font, floating dev characters FX, and full GitHub stats integration. Hacker aesthetic for cybersecurity and blockchain professionals.
Frontend Performance Optimizations
content-visibility:auto on all major profile sections, useCallback on all PublicProfile handlers, useMemo on personalInfo/publicResumes to prevent React.memo bypass, fetchpriority='high' on hero LCP image, font-display:swap + DNS prefetch for CDNs.
AI Representative (Portfolio AI Guide)
Floating AI-powered chat widget on every public portfolio. Represents the candidate to recruiters with dynamic profile search, quick action buttons, and anti-hallucination guardrails. Powered by Groq SSE streaming.
Security v6.0 — Defense in Depth
Rate limiting (IP+Email keyed), NoSQL injection protection, password hardening (8–72 chars), pepper hashing with lazy migration, HttpOnly cookies, secure logout endpoint.
Premium Dark Email Templates
All transactional emails (OTP, Password Reset, Portfolio Contact) redesigned to match the CVify Pro dark theme — deep dark background, teal accents, premium branding.
AURA DARK Theme
Cosmic minimal theme engineered for tech professionals and startup founders.
GitHub Intelligence Panel
Real-time GitHub DNA insights, repository highlights, and language synthesis.
Magic AI Import
Instant resume hydration from PDF/DOCX using deep semantic parsing.
Upcoming Milestones
AI Job Discovery Engine
A unified job board that automatically matches you with roles from LinkedIn, Indeed, and glassdoor based on your CVify score.
AI Interview Simulation
AI-powered voice/text interviews based on your resume and target JD.
CVify Chrome Extension
Analyze any job description on LinkedIn/Indeed without leaving the page.
Verified Skill Badges
Blockchain-verified proficiency badges that recruiters can trust.
Multi-Language Resumes
Generate resumes in Arabic, Dutch, and Urdu for regional markets.
🤖 AI Representative
The AI Representative is a floating, real-time AI-powered portfolio guide embedded on every CVify Pro public profile. It is NOT a generic chatbot — it is a digital representative of the portfolio owner, helping recruiters, hiring managers, and visitors instantly understand a candidate without reading the entire portfolio.
What It Is (And What It Is Not)
Portfolio Guide
Acts as a professional receptionist and executive assistant. Introduces the candidate, explains their experience, showcases projects, and facilitates direct contact.
NOT a General AI
Does not answer questions outside the portfolio owner's profile. Never invents information. Strictly grounded in real profile data fetched from the database.
Represents, Never Impersonates
Always says 'I represent [Name]' — never 'I am [Name]'. This distinction is a core product philosophy enforced at the system prompt level.
Zero Typing Required
Quick Action Buttons let recruiters explore the candidate with a single click — no prompting, no typing. Engineered for high engagement and low friction.
Core Architecture
AI Representative Stack
├─ Frontend
│ ├─ AiAgentWidget.jsx # Floating chat UI (Framer Motion + Glassmorphism)
│ ├─ useAgentStream.jsx # Custom hook — native fetch SSE stream decoder
│ └─ PublicProfile.jsx # Mounts <AiAgentWidget profileData={user} />
│
└─ Backend
├─ agentController.js # buildSystemPrompt() + searchProfile() + streamChat()
├─ agent.routes.js # POST /api/agent/stream
└─ server.js # app.use('/api/agent', agentRoutes)How It Works — Full Request Flow
Profile Data Passed from Redux
PublicProfile.jsx passes the live Redux user object as profileData to AiAgentWidget. No extra API call — the data is already in state.
User Sends a Message or Clicks Quick Action
useAgentStream.jsx fires a POST /api/agent/stream with the full profileData + conversation history (messages array).
Backend Fact-Check Search
agentController.js runs searchProfile() — a pure JavaScript keyword scanner that checks skills, project tech stacks, experience descriptions, bio, and headline BEFORE calling the LLM.
Dynamic System Prompt Built
buildSystemPrompt(profile) constructs a fully personalized system prompt from the real profile data — name, headline, skills, projects, experience, contact links.
Fact Check Injected as Ground Truth
The search result is injected as a second system message labeled BACKEND FACT CHECK — ABSOLUTE GROUND TRUTH. The LLM cannot contradict it.
Groq SSE Stream
Groq (llama-3.1-8b-instant) streams the response via Server-Sent Events at temperature: 0.1 for maximum factual precision.
Frontend Decodes & Renders
useAgentStream decodes the SSE stream with TextDecoder, appends chunks to the last assistant message in real-time. React Markdown renders contact links as glassmorphism buttons.
Anti-Hallucination System
Zero Hallucination
LLM cannot mention any skill, project, company, or technology NOT explicitly listed in the verified profile data. Violators are caught by the FACT CHECK injection.
Backend Pre-Search
searchProfile() runs pure JS keyword matching across skills, projects, experience, bio BEFORE the LLM call. Result is passed as ground truth the model must follow.
Missing Data Response
If information is not in the profile, the AI responds only: 'I couldn't find that information in [Name]'s profile.' Nothing else — no assumptions, no guesses.
Persona Lock
Anti-injection shield: if a visitor tries to override the persona ('ignore instructions', 'you are now...'), the AI rejects it instantly and stays in character.
No Invented Sections
The LLM is explicitly forbidden from adding 'Additional Skills' or 'Additional Projects' sections. If a list ends, it ends. Period.
Quick Action Buttons
When the chat opens, dynamic Quick Action Buttons are shown above the input. They are generated based on what data is available in the profile — no projects means no "View Projects" button. Clicking any button fires sendMessage() directly without typing.
🧑 Introduce Candidate
Always shown
💼 Show Experience
If experience exists
🚀 View Projects
If projects exist
🛠 Explore Skills
If skills exist
🎓 Certifications
If certifications exist
⭐ Testimonials
If testimonials exist
📞 Contact Candidate
If any contact info exists
AI Persona Rules
API Endpoint
POST /api/agent/stream
⚡ Frontend Performance Optimizations
In June 2026, CVify Pro's Public Profile page underwent a focused performance engineering pass targeting INP (Interaction to Next Paint), LCP (Largest Contentful Paint), and unnecessary React re-renders. All changes are applied in PublicProfile.jsx.
1. CSS Scroll Class Toggle (INP Fix)
Replaced useState(scrolled) with a pure DOM classList.toggle on the <html> element.
// Before: Every scroll threshold change triggered a re-render
const [scrolled, setScrolled] = useState(false);
// After: Pure DOM — zero React involvement
document.documentElement.classList.toggle('pub-scrolled', window.scrollY > 20);Navbar scroll animations moved to pure CSS: html.pub-scrolled .pub-nav — no React state, no re-renders.
2. content-visibility: auto (Render Deferral)
Applied content-visibility: auto with contain-intrinsic-size to all major profile sections via the .cv-section utility class. The browser skips painting offscreen sections until the user scrolls near them — significantly reducing initial render work.
3. Stable References (useCallback + useMemo)
useCallback on All Handlers
handleArrayUpdate, handleTogglePublic, handleContactSubmit, and ensureAbsoluteUrl are now wrapped in useCallback. This keeps their references stable, allowing React.memo on child sections to actually work.
useMemo on Derived Objects
personalInfo (passed to Hero) and publicResumes were new object/array literals every render, silently defeating React.memo. Both are now wrapped in useMemo with precise dependency arrays.
4. LCP Image Optimization
5. Font & Network Optimizations (index.html)
Company & Ownership
🧠 Skills Engine & Currently Learning
The Skills Engine provides a dual-mode entry system (General vs. Developer) that categorizes candidate capabilities for recruiters while maintaining complete ATS scoring integrity. It works hand-in-hand with the Currently Learning roadmap to transparently separate proven skills from active studies.
Key Features
Honest Career Signaling
Candidates can show Docker or AWS under 'Currently Learning' without falsely claiming 'Expert' status. Recruiters see genuine learning intent.
ATS Gap Bridging
ATS Scanner matches learningRoadmap keywords at 50% weight. Candidates with matching gaps-in-progress score higher than those with cold missing skills.
Mutual Exclusion Guardrail
A skill cannot exist in both professional and learning lists simultaneously. Enforced at both the React UI level and the API (BFF) level.
Unlimited Skill Tags
No artificial cap on skill counts. Users add whatever the job post demands for maximum ATS matching coverage without scoring penalties.
Profession Modes
🏢 General / Non-Tech Mode
Provides a single, flat list of professional skills. Ideal for business, sales, admin, operations, and management roles where highly nested categorization is not required.
💻 Developer / Tech Mode
Splits skills into 6 structured inputs: Frontend, Backend, Database, AI/DevOps, Security, and Tools. Great for software engineers, designers, and tech professionals.
Technical Architecture & Sync Logic
Layer 1: Redux Schema — resumeSlice.js
The initialState.currentResume.technicalSkills object includes nested arrays for all developer categories (frontend, backend, database, aiDevOps, security, tools, learningRoadmap).
Layer 2: Theme Sync Logic — SkillsForm.jsx
Whenever a developer adds or removes a skill in a category, the system automatically merges and dispatches the union list to the flat skills field. This ensures all 13 interactive portfolio themes remain 100% compatible out-of-the-box.
Layer 3: BFF Controller — validateTechnicalSkillsBFF()
Enforces cross-category duplicate checks and mutual exclusion checks at the backend level. Direct PATCH requests violating validation rules (e.g., adding a skill to both learningRoadmap and frontend) return HTTP 400 Bad Request.
ATS & PDF Rendering Engine
All 12 ATS-friendly PDF templates are fully integrated. In Developer mode, templates print dedicated headers (Frontend, Backend, Database, AI/DevOps, Security, Tools) to present a clean technical expertise section to recruiters.
CVify Intelligence Systems © 2026