Security

Where secrets live

Your API key is stored in your browser’s extension local storage and is sent only to the provider endpoint you configured. It is never transmitted to us and never leaves your device for any other destination. Your Pro licence is a signed token verified offline against a public key bundled in the extension, so checking it generates no network call to us. One-click activation does: it signs you in with Google at our License Center to recover your code. Pasting the code by hand does not.

What we do not hold

We operate no server that stores your résumé, your profile or your key. The single exception is the optional AutoJob Pro AI relay, which passes request content through on its way to a third-party AI provider; it is opt-in and never preselected.

Reporting a vulnerability

Email [email protected] with a description, reproduction steps and the version you tested. Please give us a reasonable chance to fix an issue before publishing it. We aim to acknowledge reports within 5 business days.

We do not run a paid bounty programme. We will credit you by name if you would like that.

Good-faith research

We will not pursue action against research conducted in good faith that avoids privacy violations, data destruction and service disruption, and that stays within your own installation and accounts.

Out of scope

The infrastructure and model behaviour of the AI provider you choose. Vulnerabilities in Chrome itself. Social engineering of us or of our processors. Reports generated solely by automated scanners with no demonstrated impact.

Machine-readable contact

The same details are served at /.well-known/security.txt in the RFC 9116 format.