0.7.0: a resume is public, the way to reach the person is not

[ralyodio]

Anyone could read a published resume and take the candidate's email address and phone number out of it. Walking /candidates and following each link produced a mailing list with phone numbers attached, which is not what somebody agreed to by publishing a resume in order to be hired.

Contact channels now need a session or a token. Everything else about the resume stays public.

What counts as a channel

It falls out of the parse rather than out of a list of key names, so it does not go stale as people invent new fields:

• a contact bullet that produced an href is a way to reach someone (mailto, tel, a profile) and is withheld
• one that did not is a plain fact and stays

So Location: Lisbon and Work Authorization: EU Citizen survive. The directory already prints the location on every card and filtering on it is the point, so withholding it there would be theatre.

Saying so, rather than going quiet

The withheld bullets are replaced by - **Contact**: shared with signed-in members instead of removed. A caller that cannot tell a redacted document from a resume with no contact details will report the second as the first. The JSON also carries contactRedacted: true so an agent does not have to guess, and the OpenAPI description and llms.txt both say it.

Redaction is Markdown in, Markdown out, and the routes re-parse the result rather than being handed a doctored parse, so the document and the parse of it can never disagree about what was withheld.

Every representation, not just the page

They all render the same Markdown, so they all go through one helper. Gating the page and forgetting the PDF is how the address stays public on a board that looks careful.

Surface	Anonymous
/candidates/:slug	withheld, with a sign-in link in the Contact card
/api/v1/candidates/:slug	withheld, contactRedacted: true
resume.md, .html, .pdf, .docx	withheld
/candidates, /candidates.md, /candidates/feed	unchanged; they never carried contact

The one thing that cannot be redacted is an original upload, since those bytes are whatever the candidate typeset. An anonymous caller asking for .pdf or .docx no longer gets that shortcut and gets a copy generated from the redacted Markdown. Worth knowing: that path needs a PDF engine, and the Docker image installs weasyprint, so this is only a change on an instance running without one.

The gate is "signed in", nothing more

Deliberately not "signed in and approved". A person with a session and an agent with a device token are the same caller here, since an agent reading resumes for its owner is the traffic this board exists to serve. What changes is that there is now an account behind the read, which is the thing a scraper does not want to have.

Testing

161 pass, including a new end-to-end test against a real Postgres that publishes a resume with an address and a phone number and checks the page, the JSON, resume.md and resume.html all withhold them anonymously and all return them with a token. Six unit tests cover the redaction rule itself, including that a link under a ## Links heading is content and is left alone.

🤖 Generated with Claude Code

https://claude.ai/code/session_015xXMzJf85q87oeG3VEKHdJ