Security controls
- Supabase authentication and owner-scoped row-level security protect account records.
- Resume storage is private and separated by user identifier. PDF/DOCX signatures, archive expansion and active or embedded content are checked before a profile Resume is stored.
- Replacement cleanup is owner-scoped and starts only after the new profile reference saves successfully; a failed profile save rolls the new upload back.
- Server-only credentials are excluded from browser bundles.
- Inbound webhooks require feature flags, signatures and idempotency identifiers.
- Stripe test-mode events never grant production paid access.
- New billing sales can be paused without disabling existing-customer cancellation, portal or account-deletion controls.
- Live submission, email and billing providers default to off until their safety gates pass.
Report a vulnerability
Use Contact and begin the message with “Security disclosure”. Include the affected URL, impact, safe reproduction steps and a contact address. Do not include credentials, other users' personal information or active exploit payloads.
There is not currently a paid bug-bounty programme. Good-faith reports are still welcomed and will be triaged responsibly.
Safe testing rules
Do not access another person's account or data, cause service degradation, send spam, upload malware, perform denial-of-service testing, use social engineering, test third-party providers, or retain information encountered accidentally. Stop immediately if you encounter personal information.
What happens next
We will acknowledge a reproducible report, assess severity, preserve relevant evidence and coordinate a proportionate fix. Public disclosure should wait until a fix is available and users are no longer exposed.