Security

Draft last updated September 23, 2026

How Resuvouch protects the data it holds, and how to tell us — responsibly — when you find something we got wrong.

Draft — not yet reviewed by a lawyer. This page describes how Resuvouch is built to behave, but it is not final legal language.

How the product is built

These are the measures actually implemented in the current version, not aspirations:

Tokens are never stored raw. Sign-in links, invite links, share links, and export links are stored as SHA-256 hashes only. A copy of the database contains no working link.
Magic links expire after 15 minutes and work exactly once. There are no passwords to steal.
Sessions live server-side, are revocable, and last at most 30 days.
Encryption. Pending reference answers and reference comments are encrypted with AES-256-GCM.
Uploads. Résumés are capped at 5MB and checked and scanned before they are ever served.
Database. Postgres row-level security backs up the application's own authorization checks.
Browser hardening. A strict Content-Security-Policy with no inline scripts, and CSRF origin checks on state-changing requests.
Audit log. Append-only — the application's database role has no UPDATE or DELETE grants on it.
Rate limits on invites, sign-ins, and share-link views.

Reporting a vulnerability

If you find a security problem, email [email protected]. Include what you found, the steps to reproduce it, and what you think the impact is. We will acknowledge your report within 3 business days, keep you posted while we fix it, and credit you if you want credit.

What is in scope

The Resuvouch web application: authentication and sessions, invite and share-link tokens, share-link scoping, access control between candidates, references, and recruiters, and file upload handling.
Anything that lets one user read or change data the product says they should not see.

Out of scope: denial-of-service and volumetric attacks, spam and social engineering of our users, reports from automated scanners with no demonstrated impact, and issues in our providers' own infrastructure (report those to the provider).

No bug bounty yet

We do not run a paid bug bounty in this version — being upfront about that beats implying otherwise. What we do promise: a real human reads every report, fixes get prioritized by impact, and good work gets acknowledged.

Good-faith research is safe here

If you research in good faith — you only touch accounts and data you own or made for testing, you do not degrade the service for others, and you give us a reasonable window to fix before publishing — we will not pursue action against you. Please never test against other people's real data; make test accounts instead.