If you discover a security issue, please do not open a public GitHub issue.

Use GitHub's private security advisory on this repository (Security → Advisories → Report a vulnerability), or open a private security discussion.

Include:

• A description of the issue and its potential impact.
• Steps to reproduce (proof of concept if possible).
• Affected version / commit.

I'll acknowledge within 48 hours and aim for a fix within 14 days.

This is a local-first personal tool. The threat model assumes:

• The app runs on 127.0.0.1 only (never exposed to the network).
• Your .env, jobhunt.db, and uploads/ stay on your machine (all gitignored).
• You review every application before submitting (human-in-the-loop).

Out of scope:

• Issues that require an attacker to already have local access to your machine.
• Abuse of third-party job boards (rate-limit evasion, ToS violations) — this project explicitly avoids those and any PR enabling them will be rejected.

Once a fix is released, I'll publish a GitHub Security Advisory crediting the reporter (unless you prefer to remain anonymous).