# Security Overview

## Purpose

Define security requirements for Jobjakt.

The application stores sensitive career information including:

- CVs.
- Employment history.
- Personal details.
- Job applications.
- Documents.
- Communication.

Security must be considered a core product requirement.

---

# Security Goals

Jobjakt should provide:

- Secure authentication.
- Strong user separation.
- Safe document handling.
- Protected APIs.
- Secure AI integrations.

---

# Security Principles

## Least Privilege

Users should only access their own data.

Admins have additional permissions.

---

## Secure By Default

Features should default to safe behaviour.

---

## Validate Everything

All external input should be considered untrusted.

Sources:

- Forms.
- APIs.
- Uploaded files.
- AI responses.
- Imported job descriptions.

---

## Do Not Over-Engineer

Security should protect users without harming usability.