Security

CareerStation is deliberately small in the ways that matter. Most of what a public website has to defend, this one does not have, because it was designed not to have it.

The Public Site Is Files

Every page you read here was built in advance and is served as a static file from a content delivery network. There is no application server on the public path and no database behind it, so the attacks that dominate web security, injection through the request, session hijacking, authentication bypass, have nothing to act on.

Nothing to Sign In To

There is no public account, no password, and no session on this site. Nothing you do here is authenticated, because nothing you do here changes anything, which removes a whole category of risk rather than defending it.

Published Under Review

Nothing reaches these pages unreviewed. Content moves from draft, to review, to published, and the person who writes something is not the person who clears it.

Encrypted, End to End

Every request is HTTPS, with modern protocols and strict transport security. Everything stored, the database, the file system, the logs, and the credentials, is encrypted at rest with a key this system owns rather than a shared default.

Very Little Is Collected

Applications, resumes, and eligibility documents are handled by USAJOBS, the federal system of record, so the most sensitive information in hiring never enters this system. What you volunteer through the Stay in Touch form is a name, an email address, and what interests you. See Privacy.

Checked on Every Change

Every change is reviewed by a person before it can ship, and is checked automatically before it can merge: dependency scanning, static analysis for security defects, secret detection, infrastructure validation, and an accessibility sweep of every page. The scanners also run weekly, because a dependency can become vulnerable without anybody touching it.

A firewall sits in front of the site, applying managed rule sets and rate limits, and traffic and access are logged.

Built to Be Assessed

The infrastructure, the content model, and the roles are all defined as code in a reviewable repository, so what is running is what somebody can read rather than something reconstructed from memory. The security documentation is written against the usual federal register, and the system is deployed into a FedRAMP-authorized environment.

Reporting Something

If you believe you have found a security problem, report it privately through the project's repository rather than in a public issue, and it will be acknowledged and worked.