JobTracker is designed to work with sensitive job-search data. A real application tracker may include email addresses, referral names, application links, notes, resume filenames, cover-letter filenames, extracted job-description data, and private preparation plans.
Do not commit personal job-search data to a public repository. Keep these files local:
.envpublic/myapplications.csv- generated analysis files in
data/ - private notes
- resume or cover-letter files
- local backup files
The repository includes a sanitized sample at public/myapplications.example.csv so visitors can run the app without private data.
The optional extraction server in server.js runs locally and sends job-posting text to a local Ollama endpoint by default. If you change the app to use a hosted model API, review what data is sent outside your machine and document that behavior before sharing it.
The server validates outbound URLs, blocks local/private/reserved network targets, rechecks redirects, restricts browser origins, and applies configurable timeout and payload limits. These controls reduce risk but do not make the local extraction service a managed public API. Add authentication, rate limiting, monitoring, and an isolated deployment environment before exposing it to untrusted internet traffic.
If you find a privacy or security issue, please open a GitHub issue with a minimal reproduction that does not include private job-search data.