Self-paced rebuild + security policy, CI, CodeQL, Dependabot, MIT license, PRD

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,21 @@
+name: Bug report
+description: Something is broken or looks wrong
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What did you expect, and what did you see instead?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: "1. Open...\n2. Click...\n3. See..."
+  - type: input
+    id: device
+    attributes:
+      label: Browser and device
+      placeholder: "Firefox 140 on Windows 11, Safari on iPhone..."

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security problem
+    url: https://github.com/Cop1ouss/secplus-tracker/security/advisories/new
+    about: Report vulnerabilities privately, not as a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,14 @@
+name: Idea or improvement
+description: Suggest a feature, a topic to cover, or a better way to do something
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: idea
+    attributes:
+      label: The idea
+    validations:
+      required: true
+  - type: textarea
+    id: why
+    attributes:
+      label: Why it would help

.github/dependabot.yml

@@ -0,0 +1,16 @@
+# Weekly dependency and Actions updates, grouped into one PR per ecosystem.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "America/New_York"
+    labels: ["dependencies"]
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      github_actions:
+        patterns: ["*"]

.github/pull_request_template.md

@@ -0,0 +1,8 @@
+## What changed
+
+## Why
+
+## Checklist
+- [ ] CI is green
+- [ ] Tested in the browser (or ran the script) myself
+- [ ] README / PRD updated if behavior changed

.github/scripts/check_site.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Repo health check run by CI: every JSON file parses, and every local link in
+HTML and Markdown files points at a file that exists. Standard library only.
+Usage: python3 .github/scripts/check_site.py [ROOT]"""
+import json, re, shutil, subprocess, sys, tempfile
+from pathlib import Path
+from urllib.parse import unquote, urlsplit
+
+ROOT = Path(sys.argv[1] if len(sys.argv) > 1 else ".").resolve()
+SKIP_DIRS = {".git", "node_modules", "dist", ".venv", "__pycache__", ".claude"}
+HTML_REF = re.compile(r'''(?:href|src)\s*=\s*["']([^"'<>]+)["']''', re.I)
+MD_REF = re.compile(r'\]\(([^)\s]+)(?:\s+"[^"]*")?\)')
+EXTERNAL = ("http:", "https:", "mailto:", "tel:", "data:", "javascript:", "#", "//", "blob:")
+
+def files(*exts):
+    for p in ROOT.rglob("*"):
+        if p.is_file() and p.suffix.lower() in exts and not SKIP_DIRS & set(p.relative_to(ROOT).parts):
+            yield p
+
+def is_local(ref):
+    return ref and not ref.startswith(EXTERNAL) and not any(c in ref for c in "${}`+") and not ref.startswith("{")
+
+errors = []
+count = {"json": 0, "links": 0}
+for f in files(".json"):
+    count["json"] += 1
+    try:
+        json.loads(f.read_text(encoding="utf-8"))
+    except Exception as e:  # noqa: BLE001
+        errors.append(f"{f.relative_to(ROOT)}: invalid JSON ({e})")
+
+for f in files(".html", ".htm", ".md"):
+    text = f.read_text(encoding="utf-8", errors="replace")
+    if f.suffix == ".md":
+        text = re.sub(r"```.*?```", "", text, flags=re.S)  # code blocks are examples, not links
+        refs = MD_REF.findall(text) + HTML_REF.findall(text)
+    else:
+        text = re.sub(r"<script\b[^>]*>.*?</script[^>]*>", "", text, flags=re.S | re.I)  # JS builds its own URLs
+        refs = HTML_REF.findall(text)
+    for ref in refs:
+        ref = ref.strip()
+        if not is_local(ref):
+            continue
+        path = unquote(urlsplit(ref).path)
+        if not path:
+            continue
+        target = (ROOT / path.lstrip("/")) if path.startswith("/") else (f.parent / path)
+        count["links"] += 1
+        if not (target.exists() or (target / "index.html").exists()):
+            errors.append(f"{f.relative_to(ROOT)}: broken link -> {ref}")
+
+# JavaScript syntax: standalone .js files and inline <script> blocks, via `node --check`.
+SCRIPT = re.compile(r"<script\b([^>]*)>(.*?)</script[^>]*>", re.S | re.I)
+count["js"] = 0
+if shutil.which("node"):
+    def node_check(code, suffix, label):
+        with tempfile.NamedTemporaryFile("w", suffix=suffix, delete=False, encoding="utf-8") as tmp:
+            tmp.write(code)
+        res = subprocess.run(["node", "--check", tmp.name], capture_output=True, text=True)
+        count["js"] += 1
+        if res.returncode:
+            msg = next((l for l in res.stderr.splitlines() if "Error" in l), res.stderr.strip()[:200])
+            errors.append(f"{label}: JavaScript syntax error ({msg})")
+    for f in files(".js", ".mjs"):
+        if "engine" in f.parts or f.name.endswith(".min.js") or f.stat().st_size > 2_000_000:
+            continue
+        node_check(f.read_text(encoding="utf-8", errors="replace"), f.suffix, f.relative_to(ROOT))
+    for f in files(".html", ".htm"):
+        for i, (attrs, code) in enumerate(SCRIPT.findall(f.read_text(encoding="utf-8", errors="replace"))):
+            a = attrs.lower()
+            if "src=" in a or not code.strip() or ("type=" in a and not re.search(r'type=["\']?(text/javascript|module)', a)):
+                continue
+            node_check(code, ".mjs" if "module" in a else ".js", f"{f.relative_to(ROOT)} <script #{i + 1}>")
+
+print(f"checked {count['json']} JSON files, {count['links']} local links and {count['js']} scripts")
+if errors:
+    print("\n".join(errors))
+    sys.exit(1)
+print("all good")

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+# Runs on every push and pull request. A red X here blocks the merge.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  site:
+    name: Links, JSON and JavaScript
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+      - name: Check every local link, JSON file and script
+        run: python3 .github/scripts/check_site.py

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+# GitHub's code scanner: looks for security bugs (XSS, injection, unsafe eval...)
+# on every pull request and every Monday.
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 9 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript-typescript"]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-extended
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dajoni Gomez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,23 +1,62 @@
-# Security+ Tracker — SY0-701 · 42-Day Sprint
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="assets/banner-dark.svg">
+  <img alt="secplus-tracker banner" src="assets/banner-light.svg" width="100%">
+</picture>
 
-![category](https://img.shields.io/badge/category-Networking%20%26%20Certs-0ea5e9)
-![exam](https://img.shields.io/badge/exam-SY0--701-38bdf8)
-![status](https://img.shields.io/badge/status-in--progress-fbbf24)
+<p align="center">
+  <a href="https://cop1ouss.github.io/secplus-tracker/"><img alt="Open the tracker" src="https://img.shields.io/badge/%E2%96%B6%20open%20the%20tracker-live%20on%20GitHub%20Pages-f38ba8?style=for-the-badge&labelColor=1e1e2e"></a>
+</p>
+<p align="center">
+  <a href="https://github.com/Cop1ouss/secplus-tracker/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/Cop1ouss/secplus-tracker/ci.yml?style=flat-square&label=CI&labelColor=1e1e2e&color=a6e3a1"></a>
+  <a href="https://github.com/Cop1ouss/secplus-tracker/actions/workflows/codeql.yml"><img alt="CodeQL" src="https://img.shields.io/github/actions/workflow/status/Cop1ouss/secplus-tracker/codeql.yml?style=flat-square&label=CodeQL&labelColor=1e1e2e&color=89b4fa"></a>
+  <a href="SECURITY.md"><img alt="Security policy" src="https://img.shields.io/badge/security-policy-f38ba8?style=flat-square&labelColor=1e1e2e"></a>
+  <img alt="exam: SY0-701" src="https://img.shields.io/badge/exam-SY0--701-f38ba8?style=flat-square&labelColor=1e1e2e">
+  <img alt="format: self-paced" src="https://img.shields.io/badge/format-self--paced%20%C2%B7%20no%20deadline-f38ba8?style=flat-square&labelColor=1e1e2e">
+  <img alt="offline: installable PWA" src="https://img.shields.io/badge/offline-installable%20PWA-a6e3a1?style=flat-square&labelColor=1e1e2e">
+  <img alt="build: none" src="https://img.shields.io/badge/build-none-a6e3a1?style=flat-square&labelColor=1e1e2e">
+</p>
 
-A gamified, self-contained study tracker for the **CompTIA Security+
-(SY0-701)** exam, built as a 42-day sprint plan. No build step, no
+<p align="center">
+  <a href="https://cop1ouss.github.io/secplus-tracker/"><img alt="secplus-tracker on desktop" src="assets/screenshot-desktop.png" width="72%"></a>
+  <a href="https://cop1ouss.github.io/secplus-tracker/"><img alt="secplus-tracker on a phone" src="assets/screenshot-phone.png" width="22%"></a>
+</p>
+
+A gamified, self-paced study tracker for the **CompTIA Security+
+(SY0-701)** exam. It covers **all 28 exam objectives across the 5
+domains**, with no calendar and no time limit: study at your own pace,
+and set an exam date only once you've booked one. No build step, no
 backend, no dependencies — every page is a standalone HTML file that
 runs straight in a browser or as an installable PWA.
 
+**How it works**
+
+- **Every objective, step by step:** for each of the 28 objectives, mark
+  *learned it*, *wrote my own notes* and *did practice questions*, then rate
+  your confidence from *Not yet* to *Exam-ready*. Key topics for each
+  objective are listed inline, with room for your own notes.
+- **Exam readiness score:** weighted by how much each domain counts on the
+  real exam (Security Operations is 28%, General Concepts 12%), so your
+  score reflects where the points actually are.
+- **Next up:** always points you at your weakest objective in the heaviest
+  domain.
+- **Practice exam log:** log every full-length score (100–900) and watch the
+  trend against the 750 pass line.
+- **XP, ranks and streaks** for momentum, plus backup and restore of your
+  progress.
+
+*Screenshots show example progress.*
+
 ## What's in here
 
 | Path | What it is |
 |---|---|
-| `index.html` | The 42-day sprint tracker — the main entry point. |
+| `index.html` | The self-paced objective tracker — the main entry point. |
+| `data/objectives.json` | All 28 SY0-701 objectives with key topics and domain weights. |
+| `sprint-2026.html` | The original 42-day sprint (Jun–Jul 2026), kept as an archive. |
 | `boss-tracker/` | An installable PWA (`manifest.json` + `sw.js` for offline use) with several linked views: |
 | `boss-tracker/game.html` | The gamified progress/boss-battle view. |
 | `boss-tracker/glossary.html` | Security+ terminology reference. |
-| `boss-tracker/schedule.html` | The day-by-day sprint schedule. |
+| `boss-tracker/schedule.html` | Course video checklist, grouped by domain. |
 | `boss-tracker/socvisualizer.html` | A Security Operations Center (SOC) workflow visualizer. |
 | `boss-tracker/stats.html` | Progress/readiness stats view. |
 | `boss-tracker/traps.html` | Common exam-question traps/gotchas log. |
@@ -42,3 +81,17 @@ client-side (browser storage) — nothing here is sent to a server.
 
 - [`ccna-tracker`](https://github.com/Cop1ouss/ccna-tracker) — CCNA 200-301 study/test-prep repo, same gamified approach.
 - [`cisco-track`](https://github.com/Cop1ouss/cisco-track) — broader networking/AD curriculum tracker (CCNA + AZ-800 + Cisco JCA).
+
+
+## Project docs
+
+| | |
+| --- | --- |
+| 📋 [PRD](docs/PRD.md) | The problem, the goal, scope and the finish line |
+| 🛡️ [Security policy](SECURITY.md) | How to report a vulnerability privately |
+| ⚖️ [License](LICENSE) | MIT |
+| 🧪 [CI](.github/workflows/ci.yml) | What runs on every pull request |
+
+---
+
+<p align="center"><sub>Built by <a href="https://github.com/Cop1ouss">Dajoni Gomez</a> · part of the <a href="https://cop1ouss.github.io/Cop1ouss/">Uncook</a> journey log</sub></p>

SECURITY.md

@@ -0,0 +1,29 @@
+# Security policy
+
+## Supported versions
+
+Only the latest version on the default branch is supported. Security+ Tracker is deployed straight from it, so a fix lands for everyone as soon as it is merged.
+
+## What this project handles
+
+Security+ Tracker has no backend, no accounts and no analytics. It stores study progress in your browser's `localStorage`. Nothing you enter is sent to a server I run.
+
+## Reporting a vulnerability
+
+Please **don't open a public issue** for a security problem.
+
+1. Go to the [Security tab](https://github.com/Cop1ouss/secplus-tracker/security) and click **Report a vulnerability**. That opens a private advisory only you and I can see.
+2. Include what you found, how to reproduce it, and what an attacker could do with it.
+
+I'll acknowledge the report within **3 days**, share a fix plan within **7 days**, and credit you in the release notes unless you'd rather stay anonymous.
+
+## How this repo is protected
+
+- **Dependabot** checks dependencies and GitHub Actions every week and opens update PRs.
+- **CodeQL** scans the code on every pull request and once a week.
+- **Secret scanning and push protection** block committed API keys and tokens.
+- **CI** must pass before anything merges into the default branch.
+
+---
+
+<sub>© 2026 Dajoni Gomez · Uncook™ · part of the [journey log](https://cop1ouss.github.io/Cop1ouss/)</sub>

boss-tracker/index.html

@@ -52,6 +52,11 @@
 
   <div class="section-lbl">MISSIONS</div>
   <div class="card-grid">
+    <a class="hub-card" data-accent="boss:d4" href="../index.html">
+      <span class="hub-card-icon">🎯</span>
+      <div class="hub-card-title">Objective Tracker</div>
+      <div class="hub-card-desc">All 28 SY0-701 objectives, self-paced. Readiness score and practice exam log.</div>
+    </a>
     <a class="hub-card" data-accent="gold" href="game.html">
       <span class="hub-card-icon">⚔️</span>
       <div class="hub-card-title">Battle Arena</div>
@@ -109,11 +114,22 @@
 }
 
 function renderCountdowns(){
-  const examDays = daysUntil(2026, 6, 30);
-  const jobDays = daysUntil(2026, 6, 20);
-  document.getElementById('countdownRow').innerHTML =
-    countdownTile(examDays, 'SY0-701 EXAM', 'Jul 30, 2026') +
-    countdownTile(jobDays, 'LEHMAN START', 'Jul 20, 2026');
+  /* Self-paced: the exam date is optional and comes from the main tracker's settings. */
+  let examDate = '';
+  try { examDate = (JSON.parse(localStorage.getItem('secplus_selfpaced_v1') || '{}').examDate) || ''; } catch(e) {}
+  const row = document.getElementById('countdownRow');
+  if(examDate){
+    const [y, m, d] = examDate.split('-').map(Number);
+    const label = new Date(y, m - 1, d).toLocaleDateString('en-US', {month:'short', day:'numeric', year:'numeric'});
+    row.innerHTML = countdownTile(daysUntil(y, m - 1, d), 'SY0-701 EXAM', label);
+  } else {
+    row.innerHTML = `
+    <div class="countdown-box">
+      <div class="countdown-num">\u221e</div>
+      <div class="countdown-lbl">self-paced</div>
+      <div class="countdown-date">set an exam date in the main tracker</div>
+    </div>`;
+  }
 }
 
 /* Card accents pull from shared/config.js so they can never drift from the