Security

In this build

• Provider secrets are server environment variables. The example file does not contain real keys.
• The public health check returns only liveness. Provider details require an admin session.
• Responses send CSP, HSTS, X-Content-Type-Options, Referrer-Policy, X-Frame-Options, and a Permissions-Policy.
• Resume uploads are checked for size, extension, and MIME type.
• The interview room does not upload camera or microphone media by default beyond optional frame analysis.
• Customers sign in with Google. There is no public password sign-up. Sessions use an httpOnly HMAC-signed cookie.
• walkinready.cloud is served through Cloudflare. The origin for this hostname accepts Cloudflare addresses. Google sign-in runs a Cloudflare check when the Turnstile keys are set.
• Student routes and the admin console are separate. Ownership checks bind API writes to the signed-in account.
• Login, upload, and AI endpoints are rate limited and return HTTP 429 when abused.
• The interview room blocks copy, the context menu, and printing, and covers the question when the window is not in front. A website cannot stop every screenshot.

Not in this build

• Password sign-up or password reset for customers. Use Google account recovery.
• Encryption-at-rest claims beyond what the host database provides.
• Independent audits, SOC reports, or ISO certificates.
• A bug-bounty program.

Report a security issue to the contact address on this site. Do not include exploit details in a public form. This page is not a promise that a report will qualify for a reward.