feat: add tips

.github/codeql/codeql-config.yml

@@ -0,0 +1,16 @@
+name: "Donut Browser CodeQL configuration"
+
+queries:
+  - uses: security-extended
+
+# Test and tooling code is not shipped. Its literals are test vectors and
+# fixtures, and the E2E harness downloads its own driver and browser bundle,
+# which the scanner reads as production secrets and untrusted writes.
+paths-ignore:
+  - e2e
+  - src-tauri/tests
+  - "**/*_tests.rs"
+  - "**/*.test.mjs"
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+  - "**/*.spec.ts"

.github/workflows/codeql.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@b1e4dc3db58c9601794e22a9f6d28d45461b9dbf #v3.29.0
         with:
-          queries: security-extended
+          config-file: ./.github/codeql/codeql-config.yml
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}