jobtrackingapp/docs/_archive/pre-docs-cleanup-2026-09-11/docs/security/api-security.md

API Security

Requirements

All APIs must:

• Authenticate correctly.
• Validate input.
• Return safe errors.

---

Rate Limiting

Protect:

• Login.
• AI endpoints.
• File uploads.
• Public CV pages.

---

API Keys

Admin-only.

Never expose:

• Provider keys.
• Secrets.
• Tokens.

---

External APIs

Validate responses.

Do not trust third-party data.