If you discover a security vulnerability in ResuMint, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email: security@resumint.ai

We will respond within 48 hours and work with you to assess and address the issue promptly.

• Passwords: Hashed with bcrypt (never stored in plaintext)
• Authentication: JWT tokens with configurable expiry
• Rate Limiting: Slowapi on all sensitive endpoints
• CORS: Restricted to specific origins (never wildcard + credentials)
• SQL Injection: Protected via SQLAlchemy ORM parameterized queries
• XSS: DOMPurify sanitization on rendered HTML content
• Admin Access: Dual-layer (JWT + emergency key), admin endpoints clearly separated

• JWT tokens are stored in localStorage (not HttpOnly cookies). This is acceptable for the current threat model but would benefit from cookie-based auth with CSRF protection for maximum security.
• The default SECRET_KEY fallback is auto-generated in development but must be explicitly set in production.