Security Practices & Architecture

1. Zero-Transmission Client-Side Execution

The most robust security posture for sensitive personal data is not collecting it in the first place. ResumeFlow’s ATS scanner, keyword extraction engine, and format analyzer are implemented entirely in client-side TypeScript that executes in your local browser sandbox.

Because raw resume text is never transmitted over HTTP routes to backend application databases for evaluation, there is zero risk of database breach or unauthorized staff access to your career records.

2. Untrusted Input Handling & XSS Mitigation

All user-supplied resume text, job posting descriptions, and builder inputs are strictly treated as untrusted data. We enforce rigorous defenses against Cross-Site Scripting (XSS):

• No arbitrary dangerouslySetInnerHTML rendering of user input strings.
• React's automatic string escaping for all dynamic text nodes.
• Sanitization of imported JSON files before hydrating state objects.

3. HTTP Transport & Transport Layer Security (TLS)

ResumeFlow strictly enforces HTTPS with modern TLS encryption across all endpoints. Plaintext HTTP traffic is automatically redirected to encrypted HTTPS connections.

4. Responsible Vulnerability Disclosure

We welcome coordinated security vulnerability reports from independent researchers. If you identify a potential security issue, report it responsibly to security@resumeflow.cv.