Security

Data at rest

User data is stored in a managed PostgreSQL database in production, with encryption-at-rest handled by the database provider. Local development uses SQLite. Uploaded resume files live in a private Supabase Storage bucket — the bucket is not publicly accessible and every read goes through a short-lived signed URL issued by the backend.

Data in transit

All traffic between your browser and our servers runs over HTTPS. Session tokens are PASETO v4.local symmetric encrypted tokens, delivered as httpOnly + Secure cookies so they are never visible to JavaScript or transmitted over plaintext.

Authentication

We use passwordless authentication: a 6-digit one-time code is sent to your email when you sign in. We don’t store passwords (there are none) and the codes are SHA-256-hashed with a per-install pepper, expire in 5 minutes, capped at 5 attempts, and single-use. Refresh tokens rotate on every use and trigger automatic full-account revocation if a stolen token is replayed.

Third-party access

A small set of sub-processors handle data on our behalf: LLM inference, file storage, billing, transactional email, bot mitigation, error monitoring, and hosting. See our sub-processor list for the current set and the data each receives. We do not run third-party analytics or advertising trackers, and we don’t sell or share your data with anyone else.

Vulnerability disclosure

Found a security issue? Please report it to: security@leaprole.com. We aim to acknowledge reports within 72 hours and to keep reporters informed throughout the remediation process.

Please give us a reasonable opportunity to investigate and fix issues before disclosing them publicly.