Security
Last updated: July 24, 2026. This page describes controls implemented in the product today, without claiming certifications or controls we have not independently verified.
Transport and application controls
Production traffic is served over HTTPS by Vercel. The application sends baseline browser security headers, keeps secrets in server-side environment variables, and scopes report, export, feedback, and deletion operations to the authenticated owner. We do not claim a particular TLS version or at-rest cipher here because those are managed by infrastructure providers and may change.
Authentication
Authentication uses Google sign-in through better-auth. Session records are stored in PostgreSQL and access to authenticated routes is checked on the server.
Database Security
Production data is stored in Neon Postgres. Authorization is enforced in application queries and database foreign keys; we do not currently claim PostgreSQL row-level security. Destructive ownership relationships use database cascades, and referral relationships are cleared when the referenced account is deleted.
Payment Security
Checkout and card collection are hosted by Dodo Payments. We store provider payment and refund identifiers, amounts, currencies, pack names, statuses, and credit movements; we do not receive or store full card numbers.
Operational safeguards
Production database migrations use the direct database endpoint and a PostgreSQL advisory lock. Preview builds skip migrations. A secret-protected scheduled endpoint marks abandoned research runs failed. These safeguards are tested in CI; this is not a claim of a formal audit or certification.
Reporting Vulnerabilities
If you discover a security vulnerability, please report it responsibly to security@interviewresources.app. Please include reproduction steps and avoid accessing other users' data. Our machine-readable disclosure contact is also published at /.well-known/security.txt.
Limitations
No internet service can guarantee absolute security. We investigate credible reports and will provide notices when required by applicable law; we do not claim a certified incident-response program, a guaranteed response time, or continuous external auditing.