Security

• Passwords are stored only as salted hashes, using a modern password hashing function.
• Verification and reset codes are random, stored only as keyed hashes, expire after 10 minutes, work once, allow a limited number of attempts, and have a resend cooldown.
• Sessions use secure cookies that scripts cannot read, short-lived access tokens, and rotating refresh tokens. A reused refresh token ends the whole session family.
• Sign-in, code, upload, and application endpoints are rate limited.

• Resumes are stored in private storage and opened only through short-lived links for the people who are allowed to see them.
• Uploaded files are checked by their real file signature and size before we use them.
• Access rules are checked on every request, so candidates see only their own data and organizations see only applications to their own jobs.

• Card numbers and security codes are typed on Paystack's checkout page and never reach Job Central.
• We keep only the card brand, last four digits, expiry, bank, and a Paystack reference used to charge renewals. That reference is never sent to the browser.
• Payment notices from Paystack are checked against a signature and confirmed with Paystack before anything changes, and each notice is handled only once.
• Saved card details stay hidden in the app until you choose to show them.

• Every request is validated on the server. Mutating requests must come from our own site.
• Text inside resumes and profiles is treated as data and is escaped when shown.
• Secrets are kept out of the code and are never written to logs.

We do not claim any security certification. We will say so plainly if that changes.

Email hello@jobcentral.com with the subject "Security". Describe the issue and how to reproduce it, and include any proof of concept. We aim to acknowledge reports within 3 business days and to keep you updated.

• Please do not access, change, or delete other people's data, and do not run attacks that degrade the service.
• Please give us reasonable time to fix an issue before you share it publicly.
• We will not take action against people who follow these rules and act in good faith.