Measures in place
- The public site is served over HTTPS with content, transport, referrer, and permissions security headers.
- The administration area uses authentication and duty-based permissions; application, partnership, and contact queues are separated.
- Resumes are stored outside the public directory and require authenticated authorization to download.
- Public forms use server validation, file type and size checks, a honeypot, minimum completion time, and short-term rate limits.
- Databases, uploads, and configuration use restricted privileges, backup, and recovery procedures.
Reporting a security issue
If you find an issue that may affect our site, data, or users, stop any action that could cause harm or access another person’s data. Select “Privacy and security” on the Contact page and include the affected page, reproduction steps, time, and contact details. Do not send unnecessary personal data, executables, or publicly disclose unresolved details.
Response boundary
We acknowledge, investigate, and address reports according to risk, but this page does not establish a bounty, authorize testing, or promise a specific response time. Contact the relevant operator for a third-party product issue.