Files
jobtrackingapp/docs/security/api-security.md
T
cesnimda b176a44627 docs: reorganize tree, restore architecture + research from archive, add Phase 0 reports
Active docs/ was stub scaffolding while the real docs sat in docs/_archive/.
Restore and correct them, and record the Phase 0 work.

- docs/architecture/current.md: verified system map (from archived SYSTEM_OVERVIEW,
  9 corrections against code).
- docs/research/competitors.md: sourced competitor analysis (from archived
  PRODUCT_RESEARCH, feature matrix corrected).
- docs/decisions/ADR-002-job-application-model.md: the Job/JobApplication split.
- docs/application-discovery-report.md, docs/implementation-roadmap.md,
  docs/phase-0-foundation-report.md, docs/career-workspace-branch-assessment.md.
- Remove 10 zero-byte placeholder files that advertised content that never existed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 17:04:32 +02:00

366 B

API Security

Requirements

All APIs must:

  • Authenticate correctly.
  • Validate input.
  • Return safe errors.

Rate Limiting

Protect:

  • Login.
  • AI endpoints.
  • File uploads.
  • Public CV pages.

API Keys

Admin-only.

Never expose:

  • Provider keys.
  • Secrets.
  • Tokens.

External APIs

Validate responses.

Do not trust third-party data.