| Version | Supported |
|---|---|
| latest | ✅ Yes |
| < latest | ❌ No |
We only provide security updates for the latest version on the main branch.
We take security seriously. If you discover a security vulnerability in this project, please report it responsibly.
- Do NOT open a public GitHub issue. Public disclosure before a fix is available puts all users at risk.
- Email us directly at: fullstackrakibul@gmail.com
- Include the following details:
- A clear description of the vulnerability
- Steps to reproduce the issue
- The potential impact of the vulnerability
- Any suggested fixes (optional but appreciated)
| Step | Timeline |
|---|---|
| Acknowledgment of your report | Within 48 hours |
| Initial assessment | Within 5 business days |
| Resolution or mitigation plan | Within 30 days |
| Public disclosure (if applicable) | After the fix is released |
PhoenixCV processes all CV data entirely client-side. No uploaded files, parsed text, or analysis results are ever transmitted to a server. This architecture eliminates entire classes of data-breach risk:
- No server-side CV storage — files are processed in-browser memory only
- No PII transmission — job descriptions and CV text never leave
localhost - No analytics tracking — no third-party scripts, cookies, or telemetry in the core app
When contributing to this project, please follow these guidelines:
- Never commit real credentials, API keys, tokens, or secrets
- Use
.envfiles for local configuration (already in.gitignore) - The mock credentials in
auth.tsare for development only — always integrate a real auth provider in production
- Keep dependencies up to date (
npm auditregularly) - Review new dependency additions for known vulnerabilities
- Prefer well-maintained packages with active communities
- Sanitize and validate all user inputs
- Use parameterized queries when integrating with databases
- Follow the principle of least privilege for API endpoints
- Never expose sensitive error details in production
⚠️ PhoenixCV is a client-side SPA. The following items should be addressed before deploying to production with real user accounts:
| Item | Status | Action Required |
|---|---|---|
| Mock authentication | Replace with real auth provider (OAuth2, JWT, etc.) | |
| No HTTPS enforcement | Configure HTTPS in your deployment | |
| No rate limiting | Add rate limiting if adding server-side endpoints | |
| No CSP headers | Configure Content Security Policy headers | |
| localStorage for tokens | Consider httpOnly cookies for production | |
| PDF.js CDN worker | Bundle worker locally for air-gapped deployments |
We appreciate the security research community and all contributors who help keep this project safe. Responsible reporters will be credited (with permission) in our release notes.
Thank you for helping keep PhoenixCV and its users safe! 🔒