Security posture, stated honestly.

Authentication

• Laravel session-based authentication. Sessions are server-side and tied to a signed, HTTP-only cookie.
• Passwords are stored as bcrypt hashes. We never see your plaintext password and cannot retrieve it.
• Two-factor authentication (TOTP) is available for every account. Enrollment lives at /settings/two-factor.
• Login attempts are logged and reviewable by admins for incident triage.

Encryption

• In transit — TLS on every public surface. Production deployments require TLS for the application, MySQL connection, and Redis connection.
• At rest — MySQL native encryption on the storage volume. Sensitive credentials (API keys, tokens) are encrypted with the application key before persistence.
• Application secrets are kept out of the repository and rotated on a defined schedule.

Application controls

• CSRF — every state-changing endpoint requires a Laravel CSRF token. Cross-site request forgery is enforced at the framework layer.
• XSS — Blade escapes by default. User-controlled inputs surfaced through specialized renderers (e.g., the bio-rewrite hedge highlighter) are escaped before any markup substitution. One historical exception in that highlighter was hardened post-audit.
• Rate limits — login throttled to 5 attempts per minute per IP. The recruiter waitlist is throttled to 5 submissions per hour. Public Pulse and Score endpoints are throttled to 60 requests per minute. The Score tool also operates under a daily LLM-budget kill switch.
• Privilege escalation defense — admin-only reflective routes are gated behind the admin middleware on top of the dev-environment check, defense in depth so a misconfigured staging environment cannot expose them to non-admin sessions.
• Shell-safe arguments — operational helpers that invoke shell commands escape every interpolated value with escapeshellarg, eliminating shell-injection vectors on internal tooling.
• Bot abuse — Cloudflare Turnstile gates anonymous public tools (Score) before any LLM call is made.

Observability and incident response

• Errors flow to Sentry. A PII scrubber filters opted-out users at the source so their identifiers never reach the error sink.
• Telemetry events flow to PostHog only when the user has explicitly opted in via /settings/privacy. Default is opt-out.
• Production runbooks cover incident response, on-call coverage, and operational diagnostics. They are reviewed before each milestone keystone.

Dependencies and supply chain

• Composer and npm dependencies are pinned and reviewed before upgrade.
• LLM access is brokered through a single internal service that enforces rate limits, caching, and circuit breakers. Providers are never called directly from feature code.
• LLMs are used only for translating unstructured input into structured ontology data. Candidate-job comparisons are deterministic and computed from stored structured data — there is no LLM in the matching loop.

Vulnerability disclosure