Hireed AI
Log in Try Hireed AI
Security & privacy

Your search, under your control.

Manage your career profile, saved roles, and search history. Understand the controls available in your workspace and how the application handles account requests.

Start searching How it works
Profile Review and update your career details
Shortlist Keep and organize promising roles
History Return to your search sessions
Per account Manage your account and preferences
Your data

The information behind your workspace

Your career profile, search criteria, saved roles, and application activity help the workspace organize your job hunt. Review the Privacy Policy for processing and data-request details.

  • Searches and saved jobs live in database records scoped to your account
  • CV profiles hold the skills, experience, and preferences you provide
  • Sign-in supports email and password, with Google options when configured
  • Account settings include appearance and sign-out controls
Controls in place

The specifics, header by header

Rather than describe the posture in the abstract, here are the actual controls the app applies — the response headers it sets, how sessions are held, what limits requests hit, and how untrusted content is handled.

01 — Transport & response headers

Set on every response, not just the marketing pages

Content-Security-Policy
default-src 'self' with base-uri 'self', object-src 'none' and frame-ancestors 'none', alongside explicit allowed origins for application scripts, fonts, authentication, and other configured services.
Strict-Transport-Security
max-age=31536000; includeSubDomains, sent over HTTPS connections so the browser refuses to downgrade to plain HTTP afterwards.
X-Content-Type-Options
nosniff — the browser honours the content type we declare instead of guessing one from the bytes.
X-Frame-Options
DENY — a second, older-browser layer of the same anti-clickjacking rule the CSP already sets.
Referrer-Policy
strict-origin-when-cross-origin — following a link out never leaks the full path you were on.
Permissions-Policy
camera=(), microphone=(), geolocation=() — explicitly denied, not merely unused.
02 — Sessions & sign-in

Sign-in and session controls

identity provider
The application supports email/password sign-in and configured Clerk or Google sign-in paths. Native passwords are stored as hashes for credential verification.
HttpOnly
The Flask session cookie is configured as HttpOnly. Authentication also uses provider tokens and sign-in markers, depending on the sign-in path.
SameSite=Lax; Secure
The Flask session uses SameSite=Lax and enables the Secure flag by default. Cookie behavior also depends on the sign-in path and deployment configuration.
require_auth
Account routes use authentication checks. Profile, saved-job, and search-session operations check the requesting account; public job listings may come from the shared catalog.
Cache-Control
Authenticated responses use cache controls including no-store, no-cache, must-revalidate, private. Static assets have separate caching rules.
03 — Database access

Account data and listing content

parameterized SQL
Account-data handlers use parameterized statements to pass submitted values separately from SQL query text.
user_id scoping
Profile, saved-job, and session operations use the signed-in account identifier. Shared catalog listings are handled separately from account activity.
text, not markup
Scraped job titles and descriptions are untrusted. They're handled as reference content and rendered through the application's text and content-sanitizing paths.
04 — Request hardening

Limits that apply before any handler runs

MAX_CONTENT_LENGTH
Request bodies are capped, so an oversized payload is rejected instead of being read into memory.
per-caller rate limiting
The sensitive paths are rate limited per caller: chat, scrape start and ingest, the OAuth callback, and per-site tests.
05 — Untrusted input

An untrusted link never becomes a blind server request

Job links arrive inside third-party HTML, which makes them attacker-influenced input. Before the server fetches any of them, the target host has to survive a chain of checks — and the chain is built to fail closed, so an unresolvable or ambiguous host is blocked rather than assumed safe.

  • Non-http(s) schemes and private, loopback or link-local addresses are refused
  • Single-label internal hostnames are blocked outright
  • A DNS failure blocks the fetch instead of letting it through
  • Every redirect hop is re-validated, so a chain can't be steered inward
Your controls

Keep your workspace up to date

Delete a search session, remove a saved role, or update your career profile as your plans change. Data export and erasure requests are described in the Privacy Policy.

  • Clear your search history from the workspace
  • Delete saved jobs once you're done with them
  • Delete a search session and its workspace links
  • Log out from account settings to end the session
  • Your theme choice stays on this device, not in your profile
Available controls
Career profile Review & edit
Saved roles Save or remove
Search sessions Return or delete
Appearance Light & dark
Account session Sign out
Straight answers

Operational notes

Application controls and deployment settings serve different purposes. This page describes implemented account controls and the available ways to ask questions or report an issue.

certifications
This page does not represent a third-party certification or independent audit of the platform.
availability
Availability depends on deployment and upstream services. This page does not state a service-level commitment.
bug bounty
Use contact and support to report an issue with the affected URL and the steps needed to reproduce it.

Found a vulnerability? Send it through contact & support with the affected URL and the steps to reproduce it. Please give us a chance to ship a fix before publishing the details.

Questions

The things people ask first

Email/password sign-in is available, with Google and Clerk paths when configured. The native sign-in flow verifies a stored password hash rather than storing the original password.

The Privacy Policy describes account, profile, workspace, and AI interaction data, service providers, and export or erasure requests.

Saved roles belong to your account's workspace. Public listing details may come from the shared catalog, while your saved state and application status are managed through account operations.

Scraped titles and descriptions are treated as untrusted data: the application uses text rendering and content-sanitizing paths. Its response policy includes default-src 'self' and object-src 'none', with explicit service-origin exceptions.

This page describes application controls and does not represent a third-party certification. For further questions, use contact & support.

Ready when you are

Search first, configure nothing

Start searching How it works