Security

Architecture

Advoke CV is a static website. It consists entirely of HTML, CSS, and JavaScript files served from Cloudflare Pages. There is no backend, no database, no user accounts, and no server-side code execution. This eliminates entire classes of security risk — SQL injection, server-side request forgery, authentication flaws, and database compromise do not apply because there is nothing to attack.

Your data

Your resume data lives in your browser's localStorage. It is protected by the same browser-level isolation that protects every other web application: no other site can read it, no third-party script can access it, and no server can retrieve it.

If your device is compromised — for example by malware, a stolen device, or a shared computer — your data could be exposed. Advoke CV cannot protect against device-level compromise. Keep your device secure and lock your screen when you step away.

Transport security

Advoke CV is served exclusively over HTTPS with HTTP Strict Transport Security (HSTS) enabled. All traffic between your browser and Cloudflare is encrypted. If you try to access an HTTP URL, the browser is redirected to HTTPS.

Security headers

Every response includes the following security headers:

• Strict-Transport-Security — forces HTTPS for future requests
• X-Content-Type-Options: nosniff — prevents MIME-type sniffing
• X-Frame-Options: DENY — prevents clickjacking by refusing to be framed
• Referrer-Policy: strict-origin-when-cross-origin — limits referrer leakage
• Permissions-Policy — disables access to camera, microphone, geolocation, and similar APIs
• Content-Security-Policy — restricts resource loading to the same origin, with no external scripts

Dependencies

Advoke CV has zero runtime dependencies. There is no jQuery, no React, no Bootstrap, no analytics library, no tracking pixel, and no third-party CDN. Every byte of JavaScript and CSS is first-party and under our control. This means there is no supply chain risk from third-party packages.

Reporting a vulnerability

If you discover a security vulnerability in Advoke CV, please report it through the contact page with the subject "Security". Please do not publicly disclose the vulnerability before it has been reviewed and addressed.

Reports that demonstrate a genuine, reproducible vulnerability in the site or its code will be acknowledged within a reasonable time and addressed where feasible.