TradeRecruit OSSign in

Security

Last updated: September 11, 2026

TradeRecruit OS takes a defense-in-depth approach to security. This page summarizes our current practices and provides information for security researchers and customers.

Security Measures

  • Transport security: TLS 1.3 encryption, HSTS with preload, strict CSP
  • Authentication: NextAuth v5 with JWT strategy, argon2 password hashing, secure cookie settings (__Secure- prefix, HttpOnly, SameSite)
  • Rate limiting: Login rate limited (5 attempts per IP per 15 minutes), AI endpoints rate limited per user
  • Input validation: Zod schema validation on all API inputs, table whitelist, UUID validation, path traversal prevention
  • File security: R2 private bucket, file size limit (10MB), content-type whitelist, authenticated downloads
  • Payment security: Stripe Checkout (card data never touches our servers), webhook signature verification, idempotency
  • Webhook security: Signature verification for Stripe and Resend webhooks, idempotency checks
  • AI security: Prompt injection detection, output validation, per-user rate limiting, human-in-the-loop required
  • Logging: Structured logging with sensitive data redaction (passwords, tokens, SSNs, API keys)
  • Audit trails: Append-only audit log for all CRUD operations, exports, and login events
  • Role-based access control: Owner, admin, and recruiter roles with server-side authorization
  • Source maps: Disabled in production browser bundles

Infrastructure

  • Hosting: Vercel (Next.js, edge deployment, CDN)
  • Database: Neon Postgres (encrypted at rest, SSL/TLS in transit, point-in-time recovery)
  • Object storage: Cloudflare R2 (private bucket, no public access)
  • Email: Resend (DKIM, webhook signature verification)
  • Payments: Stripe (PCI DSS compliant, Checkout-hosted)

Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities. If you believe you have found a security issue, please email david@wilwrx.com with:

  • A description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Your contact information (for follow-up)

We commit to:

  • Acknowledging receipt within 48 hours
  • Providing an initial assessment within 5 business days
  • Notifying you when the issue is resolved
  • Not taking legal action against good-faith researchers who follow responsible disclosure

Incident Response

In the event of a security incident, we will:

  • Investigate and contain the incident
  • Assess the scope and impact
  • Notify affected customers and candidates as required by law
  • Notify regulators as required by applicable breach notification laws
  • Document lessons learned and improve our controls

Customer Security Reviews

For enterprise security questionnaires, SOC 2 readiness status, or data processing agreements, please contact us.