https://www.obvelum.com/architecture

regarding the privacy:

- Your name doesn't come out until you choose to release it, and a company has to show salary and role details first. - Auth is self-hosted Zitadel. Google sign-in requests only openid+email, no profile scope, so Google never hands us your name. Email sign-up stores just the email address itself. - Analytics is self-hosted Umami, anonymous. Cookies are functional only.

The part I actually want comment about is the threat model: your current employer. They already know your salary, your stack, your seniority, and which tag points at them; so to them your profile is basically a name tag, even though it's anonymous to a stranger. I let you block companies, but I don't think that closes it, and with small enough fields almost any profile is unique. If you can see how to fix that, or break anything else, tell me. I don't have a security background and I'd rather find out now. About 100 profiles so far with little marketing.

Comments URL: https://news.ycombinator.com/item?id=48733739

Points: 2

# Comments: 1