Security overview
Know what you share. Understand the controls.
A practical overview of the account and data-access controls implemented in ResumeWorlds. This page is not a certification, audit report, or replacement for our legal policies.
Account authentication
The user account flow uses Firebase Authentication. Email-and-password accounts can request a password-reset email from the sign-in page. Keep control of your sign-in email and do not share your password.
Identity checks on protected APIs
Protected account APIs use a Firebase ID token sent as an Authorization Bearer token. The verification helper checks the token signature using Google signing keys and validates the Firebase project issuer and audience. Public endpoints and separate administrative flows are not all part of this account flow.
Owner-based data permissions
The repository Firestore rules check the signed-in owner for resume writes and access to personal job-tracker records. Subscription documents allow the account owner to read but deny client writes. These are specific access rules, not a claim that all information on the platform is private.
Public resume sharing is public
When a resume is marked public, the Firestore rules allow anyone to read it. The dashboard sharing action marks the selected resume public and gives you a link. Review the contact details and content before sharing; do not put sensitive information in a resume you intend to make public.
Profile discoverability is separate
A user profile marked discoverable can be read by other signed-in users, not only its owner. Jobseekers can review Recruiter Visibility in Settings. The rules place private per-user records in an owner-only subcollection; this is separate from the discoverable profile document.
Payment signature checks
Checkout uses Razorpay. The payment verification endpoint checks the signed-in Firebase user, requires the submitted user ID to match, and compares the returned payment signature with a server-generated HMAC before attempting to write a subscription record. This describes the implemented checks, not a security certification or a guarantee about every payment failure.
A few useful precautions.
- Keep your password and sign-in email secure, and sign out on shared devices.
- Check a resume for personal details before making it public or sending its link.
- Review Recruiter Visibility independently of your resume sharing choices.
- For payment support, share your order ID and registered email, not card details.
Report a security concern.
Email our support team with the affected page, a description, and the steps needed to understand the issue. Do not include passwords, tokens, payment card details, or other people's personal information. For questions about your data, use the privacy contact in our policy.
support@resumeworlds.com