registry / @hadoku/jobplatform-worker / 2.32.17
@hadoku/jobplatform-worker@2.32.17
Job listings aggregation and tracking dashboard - Worker package
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential flow is a service-authenticated request through the configured resume binding, used by authenticated resume features. The reviewed source shows no unrelated collector or automatic credential exfiltration.
Static reason
No blocking static signals were detected.
Trigger
An authenticated caller requests a resume, cover letter, or application extra.
Impact
The service processes the requested resume-related operation; no unrelated credential collection or destination was found.
Mechanism
The worker sends job and resume data through its configured RESUME service binding, including EDGE_AUTH_SECRET for service authentication.
AI rationale
The flagged credential flow is a service-authenticated request through the configured resume binding, used by authenticated resume features. The reviewed source shows no unrelated collector or automatic credential exfiltration.
Evidence
dist/index.js
Network endpoints5
resume-api/resume/api/tailored-resumeresume-api/resume/api/cover-letterresume-api/resume/api/variantsresume-api/resume/api/application-extrasresume-api/resume/api/resume
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes this as a job platform worker package.
- Resume requests use the configured RESUME service binding and send EDGE_AUTH_SECRET with the service tier header.
- Resume tailoring routes are behind an authentication gate and forward job details when those routes are called.
- The worker applies createEdgeAuth middleware to its routes.
Evidence against
- The worker makes network requests and forwards its edge authentication secret to the resume service as part of its resume-generation features.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
1{
"name": "@hadoku/jobplatform-worker",
"version": "2.32.17",
"gitHead": "[redacted]",
"description": "Job listings aggregation and tracking dashboard - Worker package",
"license": "MIT",
Low
Ai Review Evidence
The manifest describes this as a job platform worker package.
package.jsonView on unpkg · L1dist/index.jsView file
3889return env.RESUME.fetch(`https://resume-api${path}`, {
method: "POST",
headers: {
"Content-Type": "application/json",
"X-Edge-Auth": env.EDGE_AUTH_SECRET ?? "",
"X-Hadoku-Tier": "service"
Low
Ai Review Evidence
Resume requests use the configured RESUME service binding and send EDGE_AUTH_SECRET with the service tier header.
dist/index.jsView on unpkg · L38893936function registerTailoringRoutes(app2) {
app2.post("/jobs/:id/resume", gateAuthed);
app2.post("/jobs/:id/cover-letter", gateAuthed);
app2.post("/jobs/:id/resume", async (c) => {
const id = c
Findings
1 Medium6 Low
MediumNetwork
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @hadoku/jobplatform-worker@2.32.17.
See all versions of @hadoku/jobplatform-worker for other recorded verdicts.
- Review the evidence and your use of @hadoku/jobplatform-worker@2.32.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.