jobtrackingapp/docs/security/security-notes.md

Current security notes

Verified locally

• Tenant isolation, authorization replay, session revocation, upload/parser boundaries, AI sidecar token checks, PDF admission, and high-severity dependency gates have focused regression coverage.
• The AI service is not published to the host in the production Compose topology; only the backend joins its private network.
• Production Compose requires an AI service token and enables backend authentication by default.

Requires external or manual verification

• Trusted proxy/ingress CIDRs, host firewall closure, TLS/redirect behavior, and production network topology.
• Authenticated production smoke tests, real OAuth/provider behavior, email delivery, backup/restore, rollback, and key custody.
• Full keyboard/screen-reader/zoom review of the CV builder and complete production UI console cleanliness.
• Account-deletion retention policy, tombstone protection, and restored-backup erasure behavior.

These are not claims of resolved security findings. Dated evidence and the detailed P1/P2 audit packet are archived under docs/_archive/pre-docs-cleanup-2026-09-11/docs/audits/ and the pre-existing archive.