# Source navigation index

These are the primary source locations cited in [F01–F21](findings.md), at the audit baseline. This is a navigation aid, not an exhaustive endpoint or file inventory. Line numbers in the findings refer to that baseline; source will move as fixes land. Other assessed boundaries and unverified inventories are stated in [coverage.md](coverage.md).

| Source | Assessment boundary |
|---|---|
| [JobTrackerApi/Controllers/AdminAuditController.cs](../../../JobTrackerApi/Controllers/AdminAuditController.cs) | F13 — global activity access |
| [JobTrackerApi/Controllers/ApplicationCalendarController.cs](../../../JobTrackerApi/Controllers/ApplicationCalendarController.cs) | F21 — DateTime to ICS conversion |
| [JobTrackerApi/Controllers/AttachmentsController.cs](../../../JobTrackerApi/Controllers/AttachmentsController.cs) | F10 — quota check and staged upload |
| [JobTrackerApi/Controllers/BillingController.cs](../../../JobTrackerApi/Controllers/BillingController.cs) | F02 — checkout/webhook/role updates |
| [JobTrackerApi/Controllers/ClientErrorsController.cs](../../../JobTrackerApi/Controllers/ClientErrorsController.cs) | F16 — client URL/message/stack logging |
| [JobTrackerApi/Controllers/CvVariantController.cs](../../../JobTrackerApi/Controllers/CvVariantController.cs) | F01/F03 — save contract and PDF entry point |
| [JobTrackerApi/Controllers/ExportController.cs](../../../JobTrackerApi/Controllers/ExportController.cs) | F05/F10 — CSV escaping and export materialization |
| [JobTrackerApi/Controllers/UsersController.cs](../../../JobTrackerApi/Controllers/UsersController.cs) | F13 — account and role mutations |
| [JobTrackerApi/Data/JobTrackerContext.cs](../../../JobTrackerApi/Data/JobTrackerContext.cs) | F01/F10 — filters, indexes and persisted invariants |
| [JobTrackerApi/Program.cs](../../../JobTrackerApi/Program.cs) | F06/F19 — middleware order, rate policy and provider defaults |
| [JobTrackerApi/Services/AccountDeletionService.cs](../../../JobTrackerApi/Services/AccountDeletionService.cs) | F02/F13 — purge stages and external lifecycle |
| [JobTrackerApi/Services/AiOperationQueue.cs](../../../JobTrackerApi/Services/AiOperationQueue.cs) | F20 — outer worker loop exception boundary |
| [JobTrackerApi/Services/CareerProfileService.cs](../../../JobTrackerApi/Services/CareerProfileService.cs) | F01 — career aggregate update boundary |
| [JobTrackerApi/Services/CvVariantService.cs](../../../JobTrackerApi/Services/CvVariantService.cs) | F01 — revision increments and history |
| [JobTrackerApi/Services/DatabaseBackupRunner.cs](../../../JobTrackerApi/Services/DatabaseBackupRunner.cs) | F12 — SQLite snapshot primitive |
| [JobTrackerApi/Services/FollowUpReminderHostedService.cs](../../../JobTrackerApi/Services/FollowUpReminderHostedService.cs) | F07/F21 — delivery/commit and scheduling |
| [JobTrackerApi/Services/ForwardedProxyConfiguration.cs](../../../JobTrackerApi/Services/ForwardedProxyConfiguration.cs) | F04 — trusted hop/network configuration |
| [JobTrackerApi/Services/JobImport/JobImportService.cs](../../../JobTrackerApi/Services/JobImport/JobImportService.cs) | F11 — URL/DNS validation versus connection |
| [JobTrackerApi/Services/PlaywrightCvPdfExporter.cs](../../../JobTrackerApi/Services/PlaywrightCvPdfExporter.cs) | F03/F15 — browser process and output lifecycle |
| [JobTrackerApi/Services/SmtpEmailSender.cs](../../../JobTrackerApi/Services/SmtpEmailSender.cs) | F07/F16 — suppressed outcomes and private logs |
| [JobTrackerApi/Services/StripeBillingGateway.cs](../../../JobTrackerApi/Services/StripeBillingGateway.cs) | F02 — provider request identity |
| [deploy/deploy.sh](../../../deploy/deploy.sh) | F12/F18 — live backup, rollback and readiness checks |
| [docker-compose.yml](../../../docker-compose.yml) | F03/F04/F18 — exposed ports, networks and container limits |
| [docs/architecture/current.md](../../../docs/architecture/current.md) | F17 — architecture documentation drift |
| [job-tracker-ui/e2e/accessibility.spec.ts](../../../job-tracker-ui/e2e/accessibility.spec.ts) | F14 — existing axe route coverage |
| [job-tracker-ui/nginx.conf.template](../../../job-tracker-ui/nginx.conf.template) | F04/F15 — forwarding and response headers |
| [job-tracker-ui/src/App.tsx](../../../job-tracker-ui/src/App.tsx) | F08/F09 — auth lifecycle and mounted private views |
| [job-tracker-ui/src/auth.ts](../../../job-tracker-ui/src/auth.ts) | F08 — client auth notifications and storage |
| [job-tracker-ui/src/interview-prep.test.tsx](../../../job-tracker-ui/src/interview-prep.test.tsx) | F17 — standalone TypeScript failure |
| [job-tracker-ui/src/views/CvBuilderEditor.tsx](../../../job-tracker-ui/src/views/CvBuilderEditor.tsx) | F01/F09/F14/F15 — save queue, preview, state and clipboard |