Platform Hardening & Controls

Security at CareerWise

A transparent overview of the technical safeguards, validation checks, and data protection practices implemented across our stack.

01.Authentication and Authorization

Every request entering our application layer is subjected to identity verification and tenant authorization boundaries:

Edge Middleware Protection: Core application routes (/dashboard, /resume, /interview, /roadmap, /ai-cover-letter, /onboarding) are safeguarded at the network edge by Clerk middleware. Unauthenticated requests are immediately redirected before touching server memory or executing code.
Server Action Authentication: All Next.js server actions call await auth() on invocation. If a valid, non-expired session token is not present, an immediate Unauthorized exception is thrown, halting execution before any database lookup.
Strict Ownership Checks: All database queries (resumes, assessments, cover letters, roadmaps) enforce tenant isolation by strictly scoping queries to the authenticated userId. User A cannot view, update, overwrite, or delete User B's records.

02.Multi-Tier Resume Upload Protection

File upload endpoints are among the highest-risk vectors in modern web applications. CareerWise subjects every submitted resume to rigorous multi-tier validation before the file is even buffered:

Binary Magic Byte Verification

We inspect the actual initial bytes of the uploaded file buffer to verify the standard %PDF- magic byte signature, rejecting disguised executables (.exe, .sh) renamed with a .pdf extension.

4MB Size Cap & MIME Enforcement

Files exceeding 4 Megabytes (4MB) or with non-PDF MIME types (application/pdf) are blocked immediately before invoking AI models or database connections.

Zero-byte files, corrupt archives, and unsupported formats (such as Microsoft Word .docx or images) are rejected with clear user-facing guidance to export the document as a clean PDF.

03.Input Validation and Sanitization

All client-provided parameters across cover letter drafting, onboarding, interview submission, and industry selection are validated against strict type, length, and presence rules:

Job titles, company names, and job descriptions are bound by reasonable character boundaries to prevent memory overflow.
Selected industries are validated against recognized domains to avoid unexpected schema states.
Prisma ORM automatically uses parameterized SQL queries, eliminating SQL injection vulnerabilities.

04.AI Request Protection & Resilience

Interactions with generative machine learning endpoints are architected for safety and system stability:

Decoupled AI & Database Transactions: External AI invocations run strictly outside database transactions. If Gemini takes 15 seconds to return or encounters network latency, database locks are never held open, keeping Postgres connections available for other users.
Bounded Timeouts & Exponential Backoff: AI requests are bound by hard timeouts (typically 25-45 seconds) and limited to finite retry attempts to prevent hanging promises or runaway billing.
Structured JSON Output Validation: Responses returned from Gemini are parsed through strict JSON cleaners and verified against expected schema structures before DB persistence.

05.Protected Assessment & Quiz Logic

In technical mock interview assessments, quiz integrity is protected on the server side:

Zero Client-Side Answer Leakage:

When an interview quiz is delivered to the browser, the question objects contain only the question text and multiple-choice options. Correct answer keys and explanations are stored strictly on the server and are never sent down to the client until after answers have been submitted, verified, and scored.

06.Security Headers and Transport Protection

Every HTTP response includes modern browser security headers configured to mitigate common web attacks:

X-Content-Type-Options: nosniff
X-Frame-Options: DENY (Clickjacking protection)
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security (HSTS enforced via Vercel/production SSL)

07.Safe Error Handling

We practice safe error propagation: detailed database stack traces, internal connection strings, and unhandled AI exceptions are logged on the server and masked into sanitized, user-friendly error notifications (such as “AI service timed out. Please try again.” or “Unable to process resume file”) rather than exposing internal system telemetry to client browsers.

08.Infrastructure and Database Protection

CareerWise stores application data in PostgreSQL through Prisma. Production hosting must configure TLS connections, encryption at rest, backups, and a connection pool sized for the deployment. These infrastructure settings are managed by the hosting and database providers.

09.Responsible Vulnerability Disclosure

We welcome security researchers to responsibly report any potential vulnerabilities identified within CareerWise. If you discover a security concern, please send details to our security inbox with reproduction steps. We commit to investigating and patching validated vulnerabilities promptly.

Security Inquiries & Disclosure

security@careerwise.dev

10.Ongoing Hardening and Updates

We continuously audit dependencies through npm audit, apply security patches, and refine our input validation routines as new attack vectors or edge cases emerge.