OpenApply is a local-first application: it runs entirely on your own machine, binds its web server to 127.0.0.1 only, and stores your personal data (resume, contact info, work authorization answers, application history) under user_data/ on your own disk - never on a remote server the project controls, because there isn't one.

That said, it does three security-sensitive things worth being careful about: it parses files you upload (resume parsing), it drives a real browser against real third-party websites (application automation), and it can optionally call third-party AI APIs (Anthropic/OpenAI/a local endpoint) with your API key.

If you find a security issue - especially anything involving:

• path traversal or arbitrary file write via the resume upload endpoint
• credentials, API keys, or session cookies leaking into logs or the user_data/ files that a git add . might accidentally pick up
• the FastAPI server binding to anything other than 127.0.0.1 by default
• the Playwright application engine submitting a form without the user-review step, or bypassing/solving a CAPTCHA

please open a private report via GitHub's "Report a vulnerability" feature on the repository's Security tab, rather than a public issue. Include steps to reproduce and the affected version. We'll acknowledge reports within a few days.

Only the latest released version is supported with security fixes while the project is pre-1.0.

These are treated as security/ethics boundaries, not missing features - see README.md's Privacy & Security section for the full list:

• No CAPTCHA/bot-check bypassing.
• No automatic submission on LinkedIn or Indeed, ever.
• No fabricating citizenship, work authorization, sponsorship, clearance, or other sensitive answers on your behalf.
• No sending your data anywhere by default - AI providers are opt-in and only ever see job-description text and your own confirmed profile data when you explicitly enable a provider.