Lessons
1 · Reality Check and Your Search Plan
2 · Building Credibility From Zero
- 06What Credibility Means for a Fresher: Proof of Work
- 07Choose and Build a Project That Mirrors Your Target Companies
- 08Ship It: Deploy, Document and Make Your GitHub Easy to Read
- 09External Proof: Open Source, Hackathons and Writing About Your Work
- 10Honest Numbers: Measuring and Quantifying Student Projects
3 · Resume and LinkedIn
4 · Finding Jobs Before the Crowd
5 · Applications and Referrals
6 · Online Assessments and DSA
7 · Company Research for Interviews
8 · Technical Interview Rounds
9 · Behavioral and HR Rounds
10 · Offers, Negotiation and Joining
Lesson 8 · Building Credibility From Zero
Ship It: Deploy, Document and Make Your GitHub Easy to Read
A project only counts if a stranger can see it work. This article covers putting a student project online on free tiers, writing a README that answers a reviewer's questions in a minute, adding a simple architecture diagram, keeping secrets out of your repository, and setting up a GitHub profile that points straight at your best work.
For
Freshers with a project on their laptop who need to turn it into evidence recruiters and interviewers can check.
Level
Before you start
Read Choose and Build a Project That Mirrors Your Target Companies (article 7). You need a project, even a small one, to deploy.
On this page
Key takeaways
- A live link turns "I wrote some code" into "I built something that works". Deploy early, on a free tier, and say in the README if the first load is slow.
- A good README answers five questions in a minute: what it is, why it exists, how to try it, how it works and what was hard.
- A small architecture diagram, written as Mermaid in the README, helps reviewers and costs ten minutes.
- Never commit passwords, API keys or database URLs. Use environment variables and a .env file listed in .gitignore.
- A profile README, six pinned repositories and honest, regular commits make your GitHub point straight at your best work.
A recruiter opens your GitHub profile. They see twenty repositories named project1, test, java-practice and final-year-project-new, none with a description, the most recent updated eight months ago. They close the tab. It took them twelve seconds.
Another profile shows a short introduction at the top, four pinned repositories with clear names and one-line descriptions, and the first one has a live demo link. The recruiter clicks it. Now you have their attention.
Nothing about your coding ability changed between those two profiles. Only the packaging did, and the packaging is cheap to fix.
What you will learn
#- How to put a student project online for free, and what to watch out for.
- A README structure that answers a reviewer's questions in a minute.
- How to add an architecture diagram with Mermaid, which GitHub renders directly.
- How to keep secrets out of your repository.
- How to set up your GitHub profile so it leads with your best work.
Deploying: why a live link matters
#A repository without a live link says "I wrote some code". A link that loads says "I built something that runs". Many reviewers will never clone your repository and install dependencies to try it. They will click a link.
Free places to deploy
#Most student projects fit into a few kinds of hosting, each with free tiers:
What you are deploying | Kind of hosting | Examples (as of October 2026) |
|---|---|---|
A static site or frontend (HTML, React, Vue) | Static hosting with automatic deploys from Git | GitHub Pages, Vercel, Netlify, Cloudflare Pages |
A backend API (Spring Boot, Node, Django, FastAPI) | Application platforms that run a container or a process | Render, Railway, Fly.io, Koyeb and similar |
A database | Managed database with a free tier | Supabase, Neon (PostgreSQL), MongoDB Atlas |
A data analysis | A notebook or dashboard host | A public notebook on GitHub, Streamlit Community Cloud, a dashboard tool's public link |
Three practical points:
- Sleeping services. Many free backend tiers stop your service when nobody uses it and take some seconds to wake up. That is fine for a portfolio, but say so in the README ("the first request may take up to a minute while the free server starts"), or a reviewer may think it is broken.
- Expiring databases. Some free databases expire or pause after a period. Put a reminder in your calendar to check that your demo still works before every application week.
- Seed data. A demo with an empty database shows nothing. Add sample data, and if login is needed, provide a demo account in the README (with no real personal data).
A deploy checklist
#- The link loads in a normal browser, logged out, on mobile data.
- A visitor can do the main thing within a minute, with sample data or a demo login.
- Errors show a sensible message, not a stack trace.
- No secrets are visible in the page source or in error messages.
- The README says how long the first load might take.
The README: answer five questions in a minute
#A reviewer opening your repository wants to know five things, in this order. Structure your README to answer them.
# Project nameOne sentence: what it is and who it is for.Live demo: <link> (first load may take ~1 minute on the free tier)Demo login: demo@example.com / demo1234 (sample data only)## Why I built itTwo or three sentences: the problem, and why it interested you.## What it does- Feature 1- Feature 2- Feature 3A screenshot or short GIF.## How it worksA short architecture diagram (see below) and one paragraph on the flow.## The hard partThe one interesting problem and how you solved it. Link to DECISIONS.md.## ResultsWhat you measured, how, and the numbers (article 10).## Run it locallyExact commands, from clone to running, including how to set environment variables.## What I would do nextTwo or three honest improvements.The "hard part", "results" and "what I would do next" sections are what separate a portfolio README from a homework submission. They also tell an interviewer exactly what to ask you about.
Drafting the README with AI, honestly
#An assistant writes a decent first README if you feed it facts. Without facts it fills the gaps with impressive-sounding claims.
Draft a README for my project using ONLY the facts below.Follow this structure: [paste the structure above].Where a section has no facts from me, write "[to fill]" instead of inventing.Keep it plain and specific; no words like "robust", "seamless", "cutting-edge"or "scalable" unless I gave a measurement that supports them.Facts:- What it is: ...- Why I built it: ...- Features: ...- Stack and deployment: ...- The hard part and my solution: ...- Measurements: ...- How to run locally: ...Then read every sentence and check it is true. Fill each "[to fill]" yourself or delete the section.
An architecture diagram in ten minutes
#A diagram lets a reviewer understand your system in seconds. GitHub renders Mermaid diagrams written inside a fenced code block marked mermaid, so you need no drawing tool. For example:
flowchart LR Client[Web client] -->|HTTPS JSON| API[Spring Boot API] API -->|SQL| DB[(PostgreSQL)] API -->|enqueue| Q[Retry queue] Q -->|process| Worker[Payment worker] Worker -->|calls| Provider[Simulated payment provider] Worker -->|webhook| Merchant[Merchant endpoint]Label the arrows with what flows along them. Keep it to the components that exist. A diagram showing a load balancer and a cache your project does not have will be noticed.
An assistant can draft the Mermaid code from a plain description:
Write a Mermaid flowchart (flowchart LR) for this architecture. Include onlythese components and connections, with labels on the arrows:[describe: what talks to what, and what data flows]Paste it into your README and view the page on GitHub to check it renders correctly.
Keep secrets out of your repository
#This is the most common serious mistake in student repositories. Passwords, API keys, database connection strings and cloud credentials committed to a public repository can be found by automated scanners quickly, and can be misused to run up bills or access your data.
- Put secrets in environment variables. Locally, keep them in a
.envfile, and list.envin.gitignorebefore your first commit. - Commit a
.env.examplefile with the variable names and fake values, so others know what to set. - Set the real values in your hosting provider's settings, not in code.
- If you ever committed a secret, revoke it and create a new one. Deleting the file in a later commit does not remove it from the repository's history.
GitHub also has secret-scanning features that can warn you about some kinds of exposed keys, but do not rely on them as your only protection.
Your GitHub profile
#The profile README
#If you create a public repository with exactly the same name as your GitHub username and add a README.md to it, GitHub shows that README at the top of your profile page. Use it for a short introduction:
Hi, I'm [Name]. I build backend services in Java and Spring Boot.Currently building: [project], a payment service with safe retries. [link]Projects- [Project 1]: one line, live demo link- [Project 2]: one line, linkContact: [LinkedIn] · [email]Keep it short and factual. Badges and animated graphics are optional; a clear sentence about what you build is not.
Pinned repositories
#You can pin up to six repositories to your profile. Pin deliberately:
- Your strongest complete project (with a live demo).
- Your second-best project.
- A contribution to someone else's project, if you have one (article 9).
- Anything small but well made: a tool, a library, a solved problem set with good notes.
Fewer, better pins beat six weak ones.
Repository hygiene
#For every pinned repository:
- A clear, specific name (
payment-retry-service, notproject2). - A one-line description in the repository's "About" box, plus the live link in its website field.
- A few topics (for example
spring-boot,payments,idempotency), which make it easier to find. - A README following the structure above.
- A licence file if you want others to be able to reuse the code (MIT is a common simple choice).
- Meaningful commit messages ("Add idempotency key check on payment creation", not "changes").
The contribution graph, honestly
#The green squares show when you committed. Regular activity on real work signals that you keep building, and it happens naturally while you work on a project. Do not manufacture it: scripts that create empty daily commits, or meaningless changes made just to turn squares green, are easy to recognise when someone opens the commits, and they undermine everything else on the profile.
A worked example
#Rohan's profile before: 17 repositories, mostly unnamed course exercises, no profile README, one real project called mini-proj with no README and a database password in application.properties.
After one weekend:
- Revoked the database password, created a new one, moved it to an environment variable, added
.envto.gitignore. - Renamed
mini-projtocampus-events-api, deployed the backend on a free application platform and the database on a free PostgreSQL tier, added sample events. - Wrote the README with the five-question structure and a Mermaid diagram, noting the slow first load.
- Made the course-exercise repositories private, created a profile README, pinned three repositories.
His code did not change, except to remove the secret. A recruiter now sees a clear, working project in seconds.
Common mistakes
#- Deploying in the last week, then running out of time when the free tier behaves unexpectedly.
- A README that is only "npm install, npm start". It answers none of the reviewer's questions.
- Committed secrets, including in old commits.
- A diagram of an imaginary architecture. Draw what exists.
- Faking activity. Real work leaves real commits.
Exercises
#Exercise 1
Fix the README
#This is a complete README: "# Expense Tracker. A MERN app. Run npm install and npm start." Rewrite it using the five-question structure, inventing plausible details only where marked as an example.
Exercise 2: Find the secret leaks
#Which of these are problems, and what should be done? (a) application.properties contains spring.datasource.password=college123; (b) a .env.example file contains JWT_SECRET=change-me; (c) a commit three weeks ago added an API key, and a later commit removed it; (d) the frontend JavaScript bundle contains a payment provider's secret key.
Exercise 3: Choose your pins
#Ananya has: a deployed library-booking app with tests, a half-finished chat app, a merged documentation-and-test fix in an open-source date library, twelve course assignment repositories, a forked repository she never changed, and a small command-line tool that renames photos by date. What should she pin, in what order, and what should she do with the rest?
Exercise 4: Ship one project
#Deploy one project, write its README with the five-question structure and a Mermaid diagram, check it for secrets, and set up your profile README and pins. Then run the deploy checklist from a phone on mobile data.
Show solutionHide solution
An example (the specific details are illustrative and must be replaced with your own):
# Expense TrackerTrack shared expenses in a hostel room and see who owes whom.Live demo: <link> (first load can take up to a minute on the free tier)Demo login: demo@example.com / demo1234 (sample data only)## Why I built itSplitting bills among four roommates in a spreadsheet kept going wrong.I wanted settlements that need the fewest payments.## What it does- Add expenses split equally or by share- See balances per person- Get a settlement plan with the minimum number of payments[screenshot]## How it works[Mermaid diagram: React client -> Express API -> MongoDB]The API stores expenses and computes balances on request.## The hard partMinimising the number of settlement payments. I used a greedy approach thatmatches the largest debtor with the largest creditor; see DECISIONS.md forwhy, and the case where it is not optimal.## Results[measured response time for balance calculation with 1,000 expenses, and howit was measured]## Run it locallygit clone ... ; cd ... ; cp .env.example .env ; npm install ; npm start## What I would do nextRecurring expenses; export to CSV; tests for rounding with uneven splits.Exercise 2
Show solutionHide solution
(a) Problem. A real password in a committed file. Move it to an environment variable, change the password (assume it is compromised if the repository was ever public), and check the history.
(b) Not a problem. An example file with a placeholder value is exactly the right practice, as long as the real secret is different and set only in the environment.
(c) Problem. The key is still in the repository history. Revoke the key with the provider and create a new one. Rewriting history is possible but optional once the old key is useless; revoking is the essential step.
(d) Serious problem. Anything in frontend JavaScript is public. Secret keys must stay on the server. Revoke the key, move the call that needs it to your backend, and use only the provider's publishable or public key in the frontend, if it has one.
Exercise 3
Show solutionHide solution
Pin, in order:
- The library-booking app: deployed, tested, her strongest evidence.
- The merged open-source fix: outside validation (link the pull request in that repository's README or in her profile README).
- The photo-renaming tool: small but finished and useful, showing she builds tools for real problems. Give it a README.
Do not pin the half-finished chat app until it works; make it private or finish a small version. Make the course assignments private, or group them in one "coursework" repository if she wants to keep them visible. Delete the unchanged fork, which adds noise. Three strong pins are better than six mixed ones.
Exercise 4
Show solutionHide solution
Check the result against the deploy checklist and these questions:
- Can someone who has never heard of the project say what it does after reading the first three lines of the README?
- Does the live link work, logged out, on a phone?
- Does the diagram render on GitHub and show only real components?
- Does a search of the repository for "password", "secret", "key" and "token" find only placeholders?
- Does your profile page show the introduction and your best project first?
If a friend can open your profile and reach the working demo in under a minute without help, you are done.
Where to go next
#- Next: External Proof: Open Source, Hackathons and Writing About Your Work adds the signal that someone other than you values your work.
- For a portfolio website that brings your projects together, see How to Build a Developer Portfolio Website That Gets You Interviews.
- For keeping data and keys safe when you use AI tools, see Privacy and Security: What Not to Paste, Connected Tools and Prompt Injection.
- Career
- Software Engineering
- #AI
- #freshers
- #github
- #interview preparation
- #job search
- #off-campus placement
- #portfolio
Connected lessons
Linked from 2 guides
Other pages in the library that point here.
Keep reading
More in Career →Guide · Career
Interview Preparation and Mock Interviews with AI
Guide · Career
Job Descriptions, Skill Gaps and Portfolio Projects with AI
Guide · Career
A LinkedIn Profile That Gets Recruiter Messages

