Version: 1.0 Status: Draft (Phase 5) Last updated: 2026-03-12 Depends on: PRD.md, ARCHITECTURE.md, LLD/, CODE-STRUCTURE.md

This document covers security controls not already detailed in prior phases. For reference:

This document fills the gaps: security headers, CORS, CSRF, password policy, secrets management, input hardening, infrastructure security, dependency scanning, data privacy, and incident response.

All responses from the Go API pass through Nginx reverse proxy, which injects security headers. The frontend (Vercel) has its own header configuration via next.config.js.

# infra/docker/nginx.conf (security headers section)

# Prevent clickjacking
add_header X-Frame-Options "DENY" always;

# Prevent MIME-type sniffing
add_header X-Content-Type-Options "nosniff" always;

# Enforce HTTPS (1 year, include subdomains)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# Control referrer information
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Restrict browser features
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

# Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' https://*.cloudfront.net data:; connect-src 'self' https://api.careerdock.skriptvalley.com; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;

# Hide server identity
server_tokens off;

// frontend/next.config.js (headers section)
async headers() {
  return [
    {
      source: '/:path*',
      headers: [
        { key: 'X-Frame-Options', value: 'DENY' },
        { key: 'X-Content-Type-Options', value: 'nosniff' },
        { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
        { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), payment=()' },
      ],
    },
  ];
},

// internal/middleware/cors.go

func CORS(allowedOrigins []string) func(http.Handler) http.Handler {
    return cors.Handler(cors.Options{
        AllowedOrigins:   allowedOrigins,
        AllowedMethods:   []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
        AllowedHeaders:   []string{"Content-Type", "X-Request-ID"},
        ExposedHeaders:   []string{"X-Request-ID", "X-RateLimit-Limit", "X-RateLimit-Remaining", "X-RateLimit-Reset"},
        AllowCredentials: true,  // Required for httpOnly cookie auth
        MaxAge:           86400, // Preflight cache: 24 hours
    })
}

Rules:

• No wildcard (*) origins — ever. AllowCredentials: true forbids it anyway.
• Origins set via ALLOWED_ORIGINS env var (comma-separated).
• Requests from unlisted origins receive no Access-Control-Allow-Origin header — the browser blocks them.

CareerDock's auth uses httpOnly cookies with SameSite=Strict. This means:

1. Cookies are never sent on cross-origin requests (no cross-site form submission, no cross-site AJAX).
2. There is no Authorization header — the cookie is the only credential.
3. All state-changing endpoints require Content-Type: application/json, which cannot be sent by HTML forms (form submissions use application/x-www-form-urlencoded or multipart/form-data).

These three factors together eliminate CSRF without needing a separate token mechanism.

If CareerDock ever downgrades to SameSite=Lax (e.g., to support OAuth redirects), a double-submit cookie pattern must be added. Document this in an ADR if it happens.

// internal/service/auth_service.go

import "golang.org/x/crypto/bcrypt"

const bcryptCost = 12

func hashPassword(password string) (string, error) {
    bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
    return string(bytes), err
}

func checkPassword(password, hash string) error {
    return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
}

Brute-force protection via Redis sliding window:

// internal/middleware/brute_force.go

// Key: bruteforce:{ip}:{email_hash}
// Threshold: 5 failed attempts in 15 minutes → lock for 15 minutes
// After lockout expires, counter resets

const (
    maxLoginAttempts  = 5
    lockoutWindow     = 15 * time.Minute
)

Important: Error messages never reveal whether the email exists. Both "wrong email" and "wrong password" return the same generic message: "Invalid email or password".

1. User provides current password + new password.
2. Verify current password against stored hash.
3. Hash new password, update in DB.
4. Invalidate all existing refresh tokens for this user (force re-login on all devices).
5. Issue new access + refresh token pair for the current session.

Access token (15-min TTL):

{
  "sub": "01912345-6789-7abc-def0-123456789abc",
  "email": "user@example.com",
  "role": "user",
  "premium": true,
  "iat": 1709251200,
  "exp": 1709252100,
  "jti": "unique-token-id"
}

Refresh token (7-day TTL):

{
  "sub": "01912345-6789-7abc-def0-123456789abc",
  "iat": 1709251200,
  "exp": 1709856000,
  "jti": "unique-refresh-token-id"
}

Rules:

• Access token carries role and premium status — avoids DB lookup on every request.
• Refresh token is minimal — only used to issue a new access token (which re-reads from DB).
• jti (JWT ID) is a UUID v4 — used for blacklisting on logout.

Login
  ├── Verify credentials (bcrypt)
  ├── Generate access token (15 min) + refresh token (7 days)
  ├── Store refresh token JTI in Redis: session:{user_id}:{jti} → TTL 7d
  └── Set both as httpOnly/Secure/SameSite=Strict cookies

API Request
  ├── Middleware reads access token from cookie
  ├── Verify signature (HS256) + expiry
  ├── Extract claims (sub, role, premium)
  └── Proceed to handler

Token Refresh (access token expired)
  ├── Read refresh token from cookie
  ├── Verify signature + expiry
  ├── Check JTI not in blacklist (Redis)
  ├── Blacklist old refresh token JTI
  ├── Issue new access token + new refresh token (rotation)
  └── Set new cookies

Logout
  ├── Blacklist current refresh token JTI in Redis (TTL = remaining token lifetime)
  └── Clear both cookies (Set-Cookie with Max-Age=0)

Password Change
  ├── Delete ALL session:{user_id}:* keys in Redis
  └── Issue new token pair for current session only

For HS256, key rotation requires a dual-key window:

1. Generate new JWT_SECRET_NEW alongside existing JWT_SECRET.
2. Deploy with both keys:
   • Sign new tokens with JWT_SECRET_NEW.
   • Verify with JWT_SECRET_NEW first, fallback to JWT_SECRET.
3. Wait 7 days (max refresh token lifetime) for all old tokens to expire.
4. Remove JWT_SECRET (old key).
5. Rename JWT_SECRET_NEW → JWT_SECRET.

// internal/middleware/auth.go

func (a *Auth) verifyToken(tokenString string) (*Claims, error) {
    // Try current key first
    claims, err := parseJWT(tokenString, a.currentKey)
    if err == nil {
        return claims, nil
    }
    // Fallback to previous key (during rotation window)
    if a.previousKey != "" {
        return parseJWT(tokenString, a.previousKey)
    }
    return nil, err
}

Rotation frequency: At minimum annually, or immediately if key compromise is suspected.

Applied at Nginx (first line of defence) and Go handler (second line):

Resume uploads are the only file upload in the system. Validate defensively:

// internal/handler/resume.go — upload validation

func validateResumeUpload(file multipart.File, header *multipart.FileHeader) error {
    // 1. Size check (5MB max)
    if header.Size > 5*1024*1024 {
        return domain.ValidationError("File exceeds 5MB limit", map[string]any{
            "max_size_bytes": 5 * 1024 * 1024,
            "actual_size":   header.Size,
        })
    }

    // 2. Extension check
    ext := strings.ToLower(filepath.Ext(header.Filename))
    if ext != ".pdf" {
        return domain.ValidationError("Only PDF files are accepted", map[string]any{
            "allowed_extensions": []string{".pdf"},
        })
    }

    // 3. Magic bytes check (PDF starts with %PDF-)
    buf := make([]byte, 5)
    if _, err := file.Read(buf); err != nil {
        return domain.ValidationError("Unable to read file", nil)
    }
    if string(buf) != "%PDF-" {
        return domain.ValidationError("File is not a valid PDF", nil)
    }

    // 4. Reset reader position
    file.Seek(0, io.SeekStart)

    return nil
}

Consolidated from LLD/api.md:

Already enforced by architecture (parameterised queries via pgx), but explicitly codified:

Allowed:

conn.QueryRow(ctx, `SELECT * FROM users WHERE email = $1`, email)

Forbidden (will fail code review):

conn.QueryRow(ctx, fmt.Sprintf(`SELECT * FROM users WHERE email = '%s'`, email))

The golangci-lint config includes gocritic which flags string concatenation in SQL-like contexts.

Internet
    │
    ▼
┌──────────────────────────────────────────────┐
│  EC2 Security Group: careerdock-api-sg        │
│                                              │
│  Inbound Rules:                              │
│    443 (HTTPS) ← 0.0.0.0/0                 │
│    80  (HTTP)  ← 0.0.0.0/0  → redirect 443 │
│    22  (SSH)   ← your-ip/32 only            │
│                                              │
│  ┌────────────────────────────────────────┐  │
│  │ Nginx (:443) — SSL termination         │  │
│  │   ├── /api/*  → Go API (:8080)         │  │
│  │   └── health  → Go API (:8080)         │  │
│  └────────────────────────────────────────┘  │
│                                              │
│  ┌────────────┐  ┌────────────┐             │
│  │ Go API     │  │ Go Worker  │             │
│  │ :8080      │  │ (no port)  │             │
│  │ (internal) │  │ (internal) │             │
│  └─────┬──────┘  └─────┬──────┘             │
│        │                │                    │
│  ┌─────▼────────────────▼──────┐             │
│  │ Redis :6379 (internal only)  │             │
│  │ bind 127.0.0.1               │             │
│  │ requirepass <strong-pass>    │             │
│  └──────────────────────────────┘             │
└──────────────────────┬───────────────────────┘
                       │ (VPC internal)
          ┌────────────▼────────────────┐
          │  RDS PostgreSQL              │
          │  Security Group:             │
          │    5432 ← careerdock-api-sg  │
          │  No public IP                │
          │  Encryption at rest: ON      │
          └─────────────────────────────┘

          ┌─────────────────────────────┐
          │  S3                          │
          │  careerdock-resumes (private)│
          │  careerdock-logos (public/CF)│
          │  SSE-S3 encryption           │
          └─────────────────────────────┘

Dockerfile non-root user:

# Final stage of Dockerfile.api / Dockerfile.worker
RUN adduser -D -u 1000 appuser
USER appuser

Connection string (production):

postgres://careerdock:<password>@careerdock-db.xxxxx.rds.amazonaws.com:5432/careerdock?sslmode=require

Redis config (production):

bind 127.0.0.1
requirepass <strong-random-password>
appendonly yes
maxmemory 256mb
maxmemory-policy allkeys-lru

careerdock-resumes (private):

IAM policy for API/Worker:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::careerdock-resumes/*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject"],
      "Resource": "arn:aws:s3:::careerdock-logos/*"
    }
  ]
}

careerdock-logos (public via CloudFront):

# infra/docker/nginx.conf

# Force HTTPS
server {
    listen 80;
    server_name api.careerdock.skriptvalley.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.careerdock.skriptvalley.com;

    # SSL (Let's Encrypt via certbot)
    ssl_certificate     /etc/letsencrypt/live/api.careerdock.skriptvalley.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.careerdock.skriptvalley.com/privkey.pem;

    # TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # Security headers (from §2.1)
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
    server_tokens off;

    # Request size limits
    client_max_body_size 6m;                    # 5MB PDF + multipart overhead
    large_client_header_buffers 4 8k;

    # Timeouts
    proxy_connect_timeout 10s;
    proxy_read_timeout    60s;                  # AI operations can take up to 60s
    proxy_send_timeout    30s;

    # Proxy to Go API
    location /api/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Request-ID $request_id;
    }

    # Health check (no auth, no rate limit)
    location = /api/health {
        proxy_pass http://127.0.0.1:8080;
    }

    # Block everything else
    location / {
        return 404;
    }
}

# .gitignore
.env
.env.local
.env.*.local
*.pem
*.key

Pre-commit hook (from CODE-STRUCTURE.md) uses detect-secrets:

# One-time baseline setup
detect-secrets scan > .secrets.baseline

# Hook checks for new secrets on every commit
# If a real secret is detected, the commit is blocked

The structured logger (slog) must never include:

Enforcement: Code review + custom slog handler that redacts fields matching known secret patterns.

// internal/middleware/logger.go — redaction example

var sensitiveFields = map[string]bool{
    "password": true, "token": true, "secret": true,
    "authorization": true, "cookie": true, "api_key": true,
}

// Custom slog handler that replaces sensitive field values with "[REDACTED]"

Go (backend):

# In .github/workflows/ci.yml — add to backend job

- name: Vulnerability scan
  working-directory: backend
  run: |
    go install golang.org/x/vuln/cmd/govulncheck@latest
    govulncheck ./...

Node.js (frontend):

# In .github/workflows/ci.yml — add to frontend job

- name: Vulnerability scan
  working-directory: frontend
  run: npm audit --audit-level=high

Enable GitHub Dependabot:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "gomod"
    directory: "/backend"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    labels:
      - "dependencies"
      - "backend"

  - package-ecosystem: "npm"
    directory: "/frontend"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    labels:
      - "dependencies"
      - "frontend"

  - package-ecosystem: "docker"
    directory: "/infra/docker"
    schedule:
      interval: "monthly"
    labels:
      - "dependencies"
      - "infra"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
    labels:
      - "dependencies"
      - "ci"

1. Dependabot opens PR with version bump.
2. CI runs lint + test + build + vulnerability scan.
3. Review changelog for breaking changes.
4. Merge if CI passes and no breaking changes.
5. For major version bumps: manual review required.

Registration
  └── Stored: email, name, password_hash

Premium Purchase
  └── Stored: payment record (no card data), credits allocated

Resume Upload
  └── Stored: PDF in S3, extracted_text + parsed_data in Postgres

Account Deletion Request
  ├── Immediate: Soft delete (deleted_at set), all tokens invalidated
  ├── 30 days: Hard delete of user + cascaded data (lists, credits, transactions)
  └── 90 days: S3 resume PDFs purged (cleanup job)

Users can export their data via GET /api/settings/export (authenticated):

{
  "user": {
    "email": "user@example.com",
    "name": "Jane Doe",
    "role": "user",
    "premium_since": "2026-01-15T10:00:00Z",
    "created_at": "2025-12-01T08:30:00Z"
  },
  "lists": [ ... ],
  "resumes": [
    {
      "filename": "jane-doe-resume.pdf",
      "uploaded_at": "2026-01-20T14:00:00Z",
      "parsed_data": { ... },
      "download_url": "https://...signed-url..."
    }
  ],
  "ats_checks": [ ... ],
  "credits": { ... },
  "payments": [ ... ]
}

Resume PDFs are included as signed download URLs (15-minute expiry). No credit card data is included (Razorpay handles all card data).

Lightweight incident response plan for a solo-founder MVP.

For any incident:

1. Detect — Sentry alert, uptime monitor, user report, or log anomaly.
2. Assess — Determine severity (P1/P2/P3) and blast radius.
3. Contain — Stop the bleeding:
   • P1: Take affected service offline if necessary.
   • Rotate any compromised credentials immediately.
   • Force-expire all sessions: redis-cli DEL session:*
4. Fix — Deploy hotfix (tag, push, deploy).
5. Verify — Confirm fix via monitoring + manual testing.
6. Postmortem — Write a brief incident report in docs/ADR/ (what happened, root cause, fix, prevention).

Before going live, verify every item:

• JWT tokens in httpOnly/Secure/SameSite=Strict cookies
• Access token: 15-minute TTL
• Refresh token: 7-day TTL with rotation
• Logout blacklists refresh token in Redis
• Password change invalidates all sessions
• bcrypt cost factor = 12
• Brute-force lockout active (5 attempts / 15 min)
• Generic error on failed login ("Invalid email or password")

• CORS: explicit origin allowlist (no wildcards)
• Rate limiting active on all endpoints
• All input validated (handler layer)
• JSON body size limited (1MB)
• Resume upload: PDF magic bytes checked, 5MB max
• SQL: all queries parameterised (no string concatenation)

• X-Frame-Options: DENY
• X-Content-Type-Options: nosniff
• Strict-Transport-Security present
• Content-Security-Policy present
• Nginx server_tokens off

• HTTPS everywhere (Let's Encrypt for API, Vercel for frontend)
• SSH restricted to admin IP only
• RDS: no public access, encryption at rest, sslmode=require
• Redis: requirepass set, bound to localhost
• S3: block public access on resume bucket
• Docker containers run as non-root user

• .env in .gitignore
• detect-secrets pre-commit hook active
• No secrets in logs (redaction handler active)
• Production secrets in AWS Secrets Manager

• govulncheck in CI
• npm audit in CI
• Dependabot enabled

• User soft-delete works (30-day grace)
• Data export endpoint functional
• S3 cleanup job scheduled (90-day post-deletion)
• Admin audit log captures all admin actions