SHPE Convention 2026
Diego Montoya
SWE Resume Projects — Study Guide. Know why you chose each technology. Be able to defend it with your life.
Study Method
- Read the Architecture section for each project
- Memorize the "Why" tables — every tech choice has a reason
- Practice the CRUD + API flow for each project
- Know your security decisions cold
- Be ready for "Why X over Y?" comparisons
Core Principle
Priority Companies (Pure SWE)
Also Researching
Project Overview
Click any project to expand its architecture, tech stack, and design decisions.
Aidvise — AI Academic Advisor
Architecture
BROWSER (Client)
Next.js 15 React 19 TypeScript
App Router Tailwind CSS v4
APPCLOUD
nyc.cloud.appwrite.io/v1
Auth DB Permissions
Collections: users_, conversations, tasks
PUTER AI SDK
puter.ai.chat()
Streaming Client-side
Model: DeepSeek v4 Flash
REACT-MARKDOWN
remark-gfm rehype-highlight
Renders AI responses with tables, code highlighting
Request Flow
Key Design Decisions
CRUD Operations
| Entity | Create | Read | Update | Delete |
|---|---|---|---|---|
| Conversations | saveConversations() — upserts by user ID | loadConversations() — gets by user ID | saveConversations() — updates list | saveConversations() with filtered list |
| Tasks | addTask() — creates with userId scope | loadTasks() — lists, filters by userId | — (delete + recreate) | deleteTask() — deletes by doc ID |
| User Profile | createDocument() in users_ collection | getDocument() by user ID | updateDocument() by user ID | deleteDocument() + account.delete() |
Answer: "Puter.js provides a client-side SDK that handles the AI API call securely without exposing API keys. The SDK also supports streaming natively, which gives real-time chat feedback. If I needed a custom backend, I'd use Express with a server-side proxy, but for this project, the client-to-AI direct path is the right architectural choice because Puter handles authentication and key management."
Test Your Knowledge
NoteHunt — Secure Notebook PWA
Architecture
BROWSER
Next.js 15 React Service Worker
PWA: installable, offline shell, push handlers
AUTH LAYER
JWT cookie API key
httpOnly + SameSite=Lax + Secure
ROUTE HANDLERS
/api/auth/* · /api/notes/* · /api/keys/* · /api/push/*
Session cookie OR API key (Bearer / x-api-key)
DB PROXY
db.0102006.xyz
MongoDB REST API
Defensive envelope unwrap · IDOR defense · No _id hex filtering
SECURITY LAYERS
CSP nonces Rate limiting Constant-time login
IDOR defense API key hashing Security headers
Auth & Security Architecture
| Layer | Mechanism | Purpose |
|---|---|---|
| Transport | HTTPS (Vercel provides automatically) | Encrypts all data in transit |
| Session | JWT in __Host-notehunt_session cookie | httpOnly + SameSite=Lax + Secure kills CSRF by construction |
| Login | Constant-time comparison (dummy bcrypt hash for unknown emails) | Prevents user enumeration by timing |
| Rate Limiting | DB-backed (auth_attempts collection): 10 failed logins/email/15min, 20 registrations/IP/day | In-memory counters would be per-instance on serverless and trivially bypassed |
| IDOR Defense | Every read scoped by ownerId filter; every update/delete re-verifies ownership by ID | Cross-user access returns 404 (never 403), so nothing leaks |
| API Keys | nh_ prefix + 32 bytes base64url (256 bits), stored as SHA-256 hash only | Plaintext shown once at creation; revocable; capped at 5 per account |
| CSP | Nonce-based script-src, no 'unsafe-inline' for scripts | Prevents XSS via inline scripts |
| Security Headers | CSP, X-Frame-Options: DENY, nosniff, Referrer-Policy, Permissions-Policy | Defense in depth against clickjacking, MIME sniffing, etc. |
Key Design Decisions
CRUD Operations
| Endpoint | Method | Purpose | Auth |
|---|---|---|---|
| /api/auth/register | POST | Create account + session cookie | None |
| /api/auth/login | POST | Verify + session cookie | None (constant-time) |
| /api/auth/logout | POST | Clear session cookie | Session |
| /api/auth/me | GET | Session or API key check | Session OR API key |
| /api/notes | GET | List own notes (metadata only); ?q= search; ?limit= | Session OR API key |
| /api/notes | POST | Create note | Session |
| /api/notes/:id | GET/PUT/DELETE | Open/autosave/delete (ownership-checked) | Session OR API key |
| /api/keys | GET/POST | List/mint API key (session only) | Session only |
| /api/keys/:id | DELETE | Revoke key (session only) | Session only |
Answer: "I chose MongoDB via a REST proxy because it eliminates the need to host and manage a database server. The proxy handles connection pooling, security, and scaling. MongoDB's document model fits our note-taking data structure naturally — each note is a flexible document with fields like title, body, tags, and timestamps. PostgreSQL would require a schema migration pipeline and a running database instance, which adds operational complexity for a project that should focus on the application logic, not infrastructure."
Answer: "API keys are stored as SHA-256 hashes in the database — the plaintext is never persisted. When a key is created, the plaintext is shown exactly once to the user, then discarded. This means even if the database is compromised, attackers can't reverse the hashes to get usable keys. The keys are also capped at 5 per account and revocable instantly."
Test Your Knowledge
Quiz App — Note-Taking Quiz Platform
Architecture
BROWSER
Astro 7 React Service Worker
SSR-first · Island architecture · PWA
AUTH LAYER
bcryptjs JWT cookie
Constant-time login · DB rate limiting
ROUTE HANDLERS (SSR)
/api/auth/* · /api/quizzes/* · /api/keys/* · /api/push/*
/api/scheduler/* · /api/agent/* · /api/mcp.ts
DB PROXY
db.0102006.xyz
MongoDB 4.4 REST
Defensive envelope unwrap · ObjectId trap defense · IDOR on writes
EXTERNAL APIS
TMDB RAWG Google Books Deezer Open Library
All server-side · Cached with TTL · Retry with backoff
Key Design Decisions
CRUD Operations
| Entity | Create | Read | Update | Delete |
|---|---|---|---|---|
| Quizzes | POST /api/quizzes | GET /api/quizzes (list), GET /api/quizzes/[id] (detail) | PUT /api/quizzes/[id] | DELETE /api/quizzes/[id] |
| Folders | POST /api/folders | GET /api/folders | PUT /api/folders/[id] | DELETE /api/folders/[id] |
| Tags | Auto-created on quiz save | GET /api/tags (aggregated) | — | — |
| Responses | POST /api/quizzes/[id]/responses | GET /api/quizzes/[id]/responses (owner only) | — | — |
| Shares | POST /api/quizzes/[id]/share {email} | GET /api/quizzes/[id] (shared users) | PUT /api/quizzes/[id]/visibility | — |
| API Keys | POST /api/keys | GET /api/keys | — | DELETE /api/keys/[id] (revoke) |
| Push Subscriptions | POST /api/push/subscribe | GET /api/push/status | PUT /api/push/subscribe | DELETE /api/push/subscribe |
Test Your Knowledge
Giveaway Roulette
Architecture
BROWSER
Next.js 16 React 19
STYLING
Tailwind CSS v4 clsx tailwind-merge
ANIMATIONS
framer-motion (layout, gestures, SSR)
canvas-confetti (celebration FX)
GIVEAWAY LOGIC
Random selection algorithm · Winner determination · Animation triggers · Mobile responsive
Key Design Decisions
What to Study
- Random selection algorithm — how does the app pick a winner? Is it truly random or seeded?
- State management — how does the app track participants, entries, and winners?
- Animation triggers — how does framer-motion animate the winner reveal?
- Confetti timing — when does canvas-confetti fire and how is it configured?
- Mobile responsiveness — how does the layout adapt to different screen sizes?
Test Your Knowledge
Rate-It (Search It) — Entertainment Search Platform
Architecture
BROWSER
Astro 5 React (islands) Tailwind CSS v4
API UTILS (server-side)
tmdbKey() rawgKey() googleBooksKey()
cachedFetch() with retry + in-memory cache · contentFilter (family-safe)
ROUTE HANDLERS (SSR)
/movies · /books · /tv-series · /music · /anime · /games
/actors/[id] · /authors/[id] · /categories
EXTERNAL APIS (server-side only)
TMDB → movies, TV, anime · RAWG → games
Google Books → books (optional key) · Open Library → books (free fallback)
Deezer → music (no key, image proxy via wsrv.nl)
Key Design Decisions
Content Safety Architecture
The rate-it project has a comprehensive content filtering system that operates at multiple layers:
- TMDB adult flag — movies with adult=true are blocked at the API call level
- isTextSafe() — keyword-based filtering on titles, descriptions, and overviews (blocks: xxx, adult, porn, sex, erotic, nude, nsfw, hentai, etc.)
- filterMovieContent() — genre-based filtering, rating thresholds, and suspicious rating detection
- isMovieSafe() — checks adult genres, X/NC-17 certifications
- isFamilyFriendly() — most restrictive: only G/PG/PG-13 ratings, blocks Horror/Thriller/War genres
- blocklistGenres — for TV/anime/games where per-item rating data may be unavailable
Test Your Knowledge
Interview Prep — The 30 Core Questions
Click any question to reveal the answer. Practice giving a 30–60 second response for each.
Tech Stack Cheat Sheet
Click any row to expand details on why each technology was chosen over alternatives.
Company Research
SHPE Convention 2026 — Target companies and what to emphasize in conversations.
Tesla → Capital One → Datadog → Goldman Sachs / Morgan Stanley → World Wide Technology. These are your primary targets for software developer positions. Research each company's engineering blog and recent tech announcements before the convention.
🚗 Tesla — Software / Autopilot Apps
Pure SWE Target| Key Tech | Python, C++, JavaScript/TypeScript, React, Node.js, AWS, TensorFlow, autonomous driving stacks |
|---|---|
| What to Emphasize | Full-stack skills, AI/ML awareness, performance optimization, real-time systems |
| Roles to Target | Software Engineer, Frontend Engineer, Full-Stack Engineer, AI/ML Engineer |
| Interview Focus | System design, coding challenges, AI/autonomy knowledge, Tesla's mission alignment |
| Why Diego Fits | Aidvise demonstrates AI integration skills; NoteHunt shows full-stack security architecture; Rate-It shows multi-API orchestration |
💳 Capital One — Pure SWE Recruiter
Highest Volume SWE Recruiter| Key Tech | Java, Python, JavaScript/TypeScript, React, Node.js, AWS, microservices, Spring Boot |
|---|---|
| What to Emphasize | Full-stack development, cloud infrastructure, microservices, scalable systems |
| Roles to Target | Software Engineer, Full-Stack Engineer, Cloud Engineer, Backend Engineer |
| Interview Focus | Coding challenges, system design, Java/Python proficiency, cloud platforms |
| Why Diego Fits | NoteHunt demonstrates secure auth architecture; Quiz App shows full-stack with multiple data sources; all projects show production-grade patterns |
📊 Datadog — High-Tech Software
Full-Stack / AI Stack Fit| Key Tech | Go, Python, JavaScript/TypeScript, React, Node.js, AWS, Kafka, Docker, Kubernetes |
|---|---|
| What to Emphasize | Full-stack development, distributed systems, observability, cloud-native architecture |
| Roles to Target | Software Engineer, Full-Stack Engineer, Backend Engineer, Platform Engineer |
| Interview Focus | System design, coding (Go/Python/JS), distributed systems concepts, API design |
| Why Diego Fits | Rate-It demonstrates multi-API orchestration; Aidvise shows real-time streaming; NoteHunt shows production security patterns |
🏦 Goldman Sachs — FinTech SWE
FinTech Software Developer| Key Tech | Java, Python, C++, JavaScript/TypeScript, React, Spring Boot, microservices, AWS |
|---|---|
| What to Emphasize | Full-stack development, Java/Python proficiency, system design, financial systems awareness |
| Roles to Target | Software Engineer, Full-Stack Engineer, Backend Engineer, Quant Developer |
| Interview Focus | Coding challenges (Java/Python), system design, algorithms, financial domain knowledge |
| Why Diego Fits | NoteHunt shows secure auth and data isolation; Quiz App shows complex state management; all projects demonstrate production-grade code |
🏛️ Morgan Stanley — FinTech SWE
FinTech Software Developer| Key Tech | Java, Python, JavaScript/TypeScript, React, Spring Boot, AWS, microservices |
|---|---|
| What to Emphasize | Full-stack development, Java/Python, cloud platforms, scalable systems |
| Roles to Target | Software Engineer, Full-Stack Engineer, Cloud Engineer, Data Engineer |
| Interview Focus | Coding challenges, system design, Java/Python proficiency, cloud platforms |
| Why Diego Fits | Aidvise demonstrates AI integration; NoteHunt shows security architecture; Rate-It shows multi-source data aggregation |
🌐 World Wide Technology — Pure SWE Backup
Quick-Win Backup| Key Tech | Java, Python, JavaScript/TypeScript, React, Node.js, AWS, Azure, microservices |
|---|---|
| What to Emphasize | Full-stack development, cloud platforms, consulting mindset, diverse tech exposure |
| Roles to Target | Software Engineer, Full-Stack Engineer, Cloud Engineer, Solutions Engineer |
| Interview Focus | Coding challenges, system design, cloud platforms, problem-solving |
| Why Diego Fits | All 5 projects demonstrate diverse tech stacks and full-stack capability; WWT values breadth and adaptability |
Additional Companies — Hardware/Engineering Roles
These companies also attend SHPE and have software engineering roles, though they lean more toward hardware/embedded. Keep them as backup options.
🔧 Texas Instruments (TI)
Semiconductors · Embedded Systems| Key Tech | C/C++, Python, embedded C, RTOS, MATLAB, Verilog/VHDL, PCB design |
|---|---|
| What to Emphasize | Low-level programming, hardware-software interface, embedded systems, signal processing |
| Roles to Target | Embedded Software Engineer, Firmware Engineer, Software Engineer (Applications) |
| Interview Focus | C/C++ coding, embedded systems concepts, hardware understanding, problem-solving |
💾 Micron Technology
Memory · Storage Semiconductors| Key Tech | C/C++, Python, Verilog, FPGA design, memory architectures, Linux |
|---|---|
| What to Emphasize | Hardware-software co-design, memory systems, performance optimization, debugging |
| Roles to Target | Design Engineer, Software Engineer, Applications Engineer, Validation Engineer |
| Interview Focus | Digital design, memory architectures, C/C++ coding, Linux proficiency |
🚙 General Motors (GM)
Automotive · EVs · Autonomous Driving| Key Tech | C/C++, Python, Java, JavaScript/TypeScript, React, AWS, Azure, ROS, AUTOSAR |
|---|---|
| What to Emphasize | Full-stack development, automotive software, cloud infrastructure, AI/ML for autonomous driving |
| Roles to Target | Software Engineer, Embedded Software Engineer, Cloud Engineer, AI Engineer |
| Interview Focus | System design, coding, automotive software knowledge, cloud platforms |
🚗 Ford Motor Company
Automotive · EVs · Connected Cars| Key Tech | C/C++, Python, Java, JavaScript/TypeScript, React, AWS, Azure, Android Automotive |
|---|---|
| What to Emphasize | Full-stack skills, connected car technology, mobile development, cloud platforms |
| Roles to Target | Software Engineer, Mobile Engineer, Cloud Engineer, Data Engineer |
| Interview Focus | Coding, system design, mobile development, cloud/connected car tech |
⚙️ Cummins, Inc.
Engines · Power Generation · Hydrogen| Key Tech | C/C++, Python, Java, MATLAB, Simulink, PLC programming, cloud/IoT |
|---|---|
| What to Emphasize | Engineering software, IoT, data analytics, simulation tools, full-stack for industrial apps |
| Roles to Target | Software Engineer, Embedded Engineer, Data Engineer, Applications Engineer |
| Interview Focus | C/C++ coding, engineering domain knowledge, IoT/data, problem-solving |
⚡ Eaton
Power Management · Electrical Components| Key Tech | C/C++, Python, Java, MATLAB, PLC programming, cloud/IoT, CAD |
|---|---|
| What to Emphasize | Embedded systems, IoT, power electronics software, full-stack for industrial applications |
| Roles to Target | Software Engineer, Embedded Engineer, Applications Engineer, Data Engineer |
| Interview Focus | C/C++ coding, embedded systems, IoT, engineering domain knowledge |
🎵 Cadence Design Systems
EDA · Semiconductor IP| Key Tech | C/C++, Python, Perl, Tcl, Verilog/VHDL, MATLAB, Linux |
|---|---|
| What to Emphasize | EDA tools, digital/analog design, scripting, algorithm development, Python automation |
| Roles to Target | Software Engineer (EDA), Applications Engineer, Design Engineer, Python Developer |
| Interview Focus | C/C++ coding, Python, EDA concepts, digital design fundamentals, algorithm skills |
🔬 KLA Corporation
Semiconductor Inspection · Metrology| Key Tech | C/C++, Python, MATLAB, image processing, machine learning, Linux |
|---|---|
| What to Emphasize | Image processing, ML/AI, C/C++ performance, data analysis, scientific computing |
| Roles to Target | Software Engineer, Applications Engineer, Data Scientist, Imaging Engineer |
| Interview Focus | C/C++ coding, Python, image processing concepts, ML basics, problem-solving |
🔧 Lam Research
Semiconductor Equipment · Etching · Deposition| Key Tech | C/C++, Python, MATLAB, PLC, image processing, Linux, real-time systems |
|---|---|
| What to Emphasize | Embedded systems, real-time software, image processing, Python automation, hardware-software interface |
| Roles to Target | Software Engineer, Embedded Engineer, Applications Engineer, Validation Engineer |
| Interview Focus | C/C++ coding, embedded systems, image processing, Python, real-time concepts |
Architecture Defense Phrases
| # | Question | Your Answer Template |
|---|---|---|
| 1 | Why did you choose this framework? | "I chose [framework] because [specific reason: ecosystem, performance, deployment, DX]. For example, Next.js provides the App Router which gives me file-based routing and server components out of the box, and Vercel deployment is zero-config." |
| 2 | Why this database/storage? | "I chose [database] because [specific reason: document model, serverless, no hosting needed]. For NoteHunt, MongoDB via a REST proxy means I don't need to manage database infrastructure — the proxy handles connection pooling and security." |
| 3 | How does authentication work? | "I use [auth method] which [specific mechanism]. For NoteHunt, JWT in an httpOnly SameSite=Lax cookie means the token can't be accessed by JavaScript (XSS protection) and is only sent on same-site requests (CSRF protection). Logout clears the cookie via the response API." |
| 4 | How do you handle security? | "I implemented [security measure] because [specific threat]. For example, DB-backed rate limiting prevents brute-force attacks even on serverless where in-memory counters would be per-instance and trivially bypassed. Constant-time login prevents user enumeration by timing." |
| 5 | What would you improve? | "If I had more time, I would [specific improvement: add tests, TypeScript strict mode, better error boundaries, more granular caching, CI/CD pipeline]. The project is solid but there's always room for engineering excellence." |
Common "Why X over Y?" Questions
| Question | Answer |
|---|---|
| Why React over Vue/Svelte? | "React has the largest ecosystem, the most job market demand, and React 19's concurrent features are industry-leading. My portfolio is React-focused which shows depth over breadth." |
| Why Next.js over Astro? | "Next.js is the best choice for interactive, data-driven applications like Aidvise and NoteHunt where real-time chat and authentication are core features. Astro is better for content-heavy, mostly-static sites like Rate-It where the primary function is browsing and searching." |
| Why Tailwind over CSS Modules? | "Tailwind's utility-first approach lets me build consistent designs rapidly without writing custom CSS. The design tokens ensure consistency across all projects, and the responsive utilities make mobile-first design trivial." |
| Why MongoDB over PostgreSQL? | "MongoDB's document model fits our flexible, schema-less data (notes, quizzes, tasks). The REST proxy eliminates database hosting. PostgreSQL would require schema migrations and a running database instance, adding operational complexity." |
| Why Vercel over AWS/self-hosted? | "Vercel provides zero-config deployment for Next.js and Astro, automatic SSL, global CDN, and preview deployments for PRs. Self-hosting would require DevOps overhead that doesn't align with my goal of building applications, not infrastructure." |
| Why bcrypt over argon2? | "bcrypt is the battle-tested industry standard for password hashing. It's built into Node.js ecosystem, has constant-time comparison built-in, and is resistant to GPU-based attacks. argon2 is newer and has theoretical advantages but bcrypt is proven in production at scale." |
| Why JWT over server-side sessions? | "JWT is stateless — no server-side session store needed. This scales horizontally without shared state. Combined with httpOnly cookies, it provides secure authentication without the complexity of a session database." |
| Why a REST proxy for MongoDB? | "A REST proxy means the database API key never reaches the browser. All database calls go through the server, which enforces authentication and authorization. Direct MongoDB drivers in the browser would expose credentials and bypass security controls." |
Final Tips for SHPE Convention 2026
- Be honest about what you built and what you didn't. Interviewers respect honesty more than bluffing.
- Practice the "5 Whys" for every tech choice. If you say "I used MongoDB," be ready for "Why MongoDB?" → "Why not PostgreSQL?" → "Why not Firebase?" → etc.
- Bring a laptop with your projects deployed. Have Vercel preview links ready. Let recruiters see your work live.
- Prepare a 60-second pitch for each project: what it does, what tech stack it uses, and one interesting technical challenge you solved.
- Network beyond the companies you're targeting. Talk to other students, alumni, and recruiters from companies you haven't considered.
- Research each company's recent news before the convention. Know their products, recent launches, and engineering blog posts.
- Dress professionally but comfortably. Business casual is the standard for tech conventions.
- Bring plenty of resumes and a digital version on your phone.
- Follow up within 24 hours of meeting recruiters — send a brief email referencing your conversation.
- Remember: the convention is a two-way street. You're evaluating them as much as they're evaluating you. Ask about culture, growth opportunities, and team dynamics.
You've built impressive projects with real architecture decisions. The fact that you can explain why you chose each technology is what will set you apart. Prepare your stories, know your stack, and be confident.