Security
How we protect your data and what to do if you find a vulnerability.
Authentication
- Passwords are stored using ASP.NET Core Identity's default hasher (PBKDF2 with HMAC-SHA256, 100,000+ iterations).
- OAuth sign-in is supported via Google, Microsoft, Facebook, LinkedIn, and Instagram (where configured) — your password is never sent to us in those flows.
- Session cookies are marked HttpOnly + Secure in production and rotated on sign-in.
Data in transit
All traffic to the production deployment is served over HTTPS via Let's Encrypt or an equivalent CA. HSTS is enabled.
Data at rest
The database (SQLite or Postgres) sits on encrypted storage on the host. CV uploads live on a persistent volume on the same host (or in object storage if configured).
AI provider isolation
The AI backend is configurable. Choose Ollama for fully local processing where no CV text ever leaves the host. Choose Claude if you prefer top-tier model quality — Anthropic processes the request via their enterprise API and does not train on your data.
Reporting a vulnerability
If you find a security issue, please email the address in the footer with:
- A description of the issue and its impact
- Reproduction steps
- Any relevant logs or screenshots
We aim to acknowledge within 48 hours and to patch high-severity issues within 7 days. Please do not publicly disclose until we've had a chance to fix it.
Out of scope
- Reports requiring physical access to the user's device
- Self-XSS / social engineering
- Missing security headers without a working exploit
- Rate-limiting reports that don't lead to account takeover or data exposure