| Version | Supported |
|---|---|
| 1.2.x | ✅ Active |
| < 1.2 | ❌ No longer supported |
ResumeFlow is a fully client-side application with no backend, no server, and no database. All data stays in your browser's localStorage. However, we still take security seriously — particularly around XSS risks in user-generated content rendered in the preview.
If you discover a security vulnerability, please do NOT open a public GitHub issue.
Instead, please report it privately by:
- Opening a GitHub Security Advisory (preferred), or
- Emailing the maintainer directly with a detailed description.
We will acknowledge your report within 48 hours and provide a patch timeline within 7 days.
| Protection | Implementation |
|---|---|
| XSS Prevention | All user input passes through a static entity-map escapeHtml() before rendering |
| JSON Import Validation | Imported files are type-checked (application/json), size-limited (5MB), and schema-merged |
| No External Requests | The app makes zero network requests at runtime (fonts/icons load from CDN at page load only) |
| Immutable Config | App constants are frozen via Object.freeze() preventing runtime tampering |
rel="noopener noreferrer" |
All generated external links include this attribute to prevent tab-napping |
Issues we consider in scope:
- XSS vulnerabilities via malicious resume data or imported JSON
- localStorage manipulation attacks
- Link injection via resume fields
Issues we consider out of scope:
- Vulnerabilities in Font Awesome or Google Fonts CDN
- Browser-level security issues
- Social engineering attacks