B
Loading Beacon...
Loading Beacon...
Trust center
Your career data is sensitive. Here is how we protect it — and what to do if something looks wrong.
Passwords are handled by Supabase Auth with bcrypt hashing. Sessions live in secure HTTP-only cookies — tokens never touch localStorage.
Postgres RLS policies ensure every user can only read and write their own profile and data. Service-role access is restricted to server code.
All traffic runs over HTTPS. API keys and service credentials stay in server-side environment variables and are never shipped to the browser.
Auth, resume, and AI endpoints are rate-limited per IP to blunt brute-force and abuse.
Admin tooling is gated behind role checks on every request, and sensitive operations are audit-logged.
Found a vulnerability? Use the bug-report button in the header or the Contact page. Please allow us time to fix before disclosing publicly.