At JobPrep AI, we take security seriously. This document outlines our security policies, how to report vulnerabilities, and our security practices.

We provide security updates for the following versions:

Instead, please report security vulnerabilities via email:

Email: security@aliammari.com Subject: [SECURITY] Brief description of the issue

Please include the following information in your report:

1. Type of vulnerability

   • Authentication/Authorization bypass
   • SQL injection
   • XSS (Cross-Site Scripting)
   • CSRF (Cross-Site Request Forgery)
   • Data exposure
   • API abuse
   • Other (please describe)

2. Location

   • Affected URL(s)
   • Affected component(s)
   • Affected code file(s) and line numbers

3. Impact

   • What data could be accessed or modified?
   • Who could be affected?
   • What is the potential damage?

4. Steps to Reproduce

   • Detailed step-by-step instructions
   • Proof of concept (if applicable)
   • Screenshots or video (if helpful)

5. Suggested Fix (optional)

   • If you have ideas on how to fix the issue

6. Your Details (optional)

   • Name (for credit in security advisories)
   • Organization
   • PGP key (if you want encrypted communication)

Subject: [SECURITY] Authentication bypass in interview room access

Type: Authorization bypass

Location:
- URL: /api/interviews/[id]/join
- File: src/app/api/interviews/[id]/join/route.ts:23

Impact:
- Unauthenticated users can join any interview room with just the room ID
- Allows access to private interview sessions
- Could expose user interview data

Steps to Reproduce:
1. Log out of the application
2. Navigate to /api/interviews/abc123/join
3. Observe that room access is granted without authentication

Suggested Fix:
Add authentication middleware to verify user session before allowing room access.

We are committed to addressing security vulnerabilities promptly:

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline:
  • Critical: Within 7 days
  • High: Within 14 days
  • Medium: Within 30 days
  • Low: Within 60 days

We appreciate security researchers who responsibly disclose vulnerabilities. Contributors will be:

• Credited in our security advisories (if desired)
• Listed in our Hall of Fame (coming soon)
• Considered for bounties (for critical vulnerabilities, when budget permits)

1. Keep Your Account Secure

   • Use strong, unique passwords
   • Enable 2FA (Two-Factor Authentication)
   • Consider using passkey authentication
   • Don't share your credentials

2. Protect Your API Keys

   • Never commit API keys to version control
   • Use environment variables
   • Rotate keys regularly
   • Use different keys for development and production

3. Stay Updated

   • Update to the latest version
   • Review security advisories
   • Check for dependency updates

4. Safe Self-Hosting

   • Use HTTPS only
   • Configure proper CORS policies
   • Set up rate limiting
   • Use firewall rules
   • Regular backups

1. Secure Coding Practices

   • Validate all user input
   • Use parameterized queries (Prisma handles this)
   • Sanitize output to prevent XSS
   • Implement proper authentication checks
   • Use CSRF tokens for state-changing operations

2. Dependency Management

   • Keep dependencies updated
   • Review dependency security advisories
   • Watch Renovate PRs and Trivy/CodeQL CI findings
   • Avoid dependencies with known vulnerabilities

3. Sensitive Data

   • Never log sensitive data (passwords, tokens, API keys)
   • Encrypt sensitive data at rest
   • Use secure transmission (HTTPS/TLS)
   • Follow data minimization principles

4. Code Review

   • All code must be reviewed before merging
   • Security-sensitive changes require extra scrutiny
   • Use automated security scanning tools

• ✅ Modern Authentication: Better Auth with passkey support
• ✅ Two-Factor Authentication (2FA): TOTP and SMS support
• ✅ Session Management: Secure cookie-based sessions
• ✅ Password Security: Bcrypt hashing with salt
• ⚠️ OAuth integration: Google and LinkedIn routes exist; state/PKCE/session-binding remediation is tracked before production enablement

• ⚠️ Rate Limiting: Upstash limits cover selected AI and LiveKit routes when Redis is configured; this is not a blanket API control
• ⚠️ Input Validation: New security-sensitive endpoints use schema validation; legacy routes require ongoing review
• ✅ SQL Injection Protection: Prisma ORM with parameterized queries
• ✅ XSS Protection: React's built-in escaping + CSP headers
• ⚠️ CSRF Protection: Better Auth protects its own flows; application routes require endpoint-specific review

• ⚠️ Encryption at Rest: Depends on the selected managed PostgreSQL and storage provider configuration
• ✅ Encryption in Transit: TLS is terminated by the deployment platform
• ⚠️ Integration tokens: Stored by the application; application-level encryption has not been implemented
• ⚠️ File storage: Signed URLs and expiration depend on the selected storage backend and are not currently a universal control

• ✅ Security Headers: CSP, HSTS, X-Frame-Options, etc.
• ⚠️ HTTPS redirect: Configure this at the Cloudflare zone/edge; it is not enforced by this repository alone
• ✅ Environment Isolation: Separate dev/staging/production
• ✅ Secure Deployment: Cloudflare's edge network (TLS at the edge, DDoS protection); the Python avatar agent runs on an isolated container

• ✅ Error Tracking: Sentry integration (if enabled)
• ⚠️ Audit Logs: No general-purpose audit log is implemented
• ✅ Security Alerts: Automated vulnerability scanning

JobPrep AI integrates with several third-party services. While we implement security best practices, users should be aware:

1. AI Providers (Gemini, OpenAI, Claude)

   • Interview responses are sent to AI APIs for analysis
   • Review provider privacy policies
   • Use local Ollama for private deployments

2. LiveKit (Video/Audio)

   • Real-time video/audio streams
   • End-to-end encrypted by default
   • Check LiveKit security documentation

3. Stripe (Payments)

   • PCI-DSS compliant payment processing
   • No credit card data stored on our servers
   • Stripe's security guarantees apply

4. Appwrite (File Storage)

   • Files stored with access controls
   • Signed URLs with expiration
   • Review Appwrite security settings

If you're self-hosting JobPrep AI:

1. Database Security

   • Use strong PostgreSQL passwords
   • Enable SSL/TLS for database connections
   • Restrict database access to application servers only
   • Regular backups with encryption

2. API Key Management

   • Store API keys securely (use secrets management)
   • Never commit .env files
   • Use different keys per environment
   • Rotate keys periodically

3. Server Security

   • Keep OS and packages updated
   • Use firewall rules
   • Enable fail2ban or similar
   • Monitor logs for suspicious activity

4. SSL/TLS Certificates

   • Use Let's Encrypt or similar
   • Enable HSTS
   • Configure strong cipher suites

• Dependency Audits: Weekly via Renovate bot
• Code Scanning: Automated via GitHub CodeQL
• Penetration Testing: Annual third-party assessment (planned)
• Security Reviews: For all major releases

• 2025-03: Initial security policy established
• 2025-01: Implemented passkey authentication
• 2024-12: Added 2FA support
• 2024-11: Enhanced rate limiting

• OWASP Top 10
• Better Auth Security
• Next.js Security
• Prisma Security

• GitHub CodeQL: Static code analysis (JS/TS)
• gitleaks: Secret scanning in CI
• Trivy: Dependency & lockfile vulnerability scanning
• dependency-review-action + OpenSSF Scorecard: Supply-chain checks
• Renovate: Automated dependency updates
• Biome: Code quality and lint rules (no ESLint)

We implement the following security headers:

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; ...
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()

For security concerns:

• Email: security@aliammari.com
• Response Time: Within 48 hours
• Public Key: Available upon request

For general questions:

• Email: contact@aliammari.com
• GitHub Discussions: For non-security issues

We request that security researchers:

1. Don't publicly disclose vulnerabilities before we've had a chance to fix them
2. Don't exploit vulnerabilities beyond what's necessary to demonstrate the issue
3. Don't access, modify, or delete user data
4. Do give us reasonable time to fix issues before disclosure
5. Do work with us to understand and resolve the issue

We will not pursue legal action against security researchers who:

• Act in good faith
• Follow this responsible disclosure policy
• Don't violate laws or access user data unnecessarily
• Report findings responsibly

This security policy may be updated periodically. Major changes will be announced via:

• GitHub releases
• Email to registered users
• Twitter @aliammari1

Last Updated: March 24, 2026 Version: 1.0

Thank you for helping keep JobPrep AI and our users safe! 🛡️