Security & Trust
Draft version · last updated August 2026
Authentication
- Passwords are hashed using WordPress core's standard password hashing — we never store or see plain-text passwords.
- Email verification uses a real, time-limited 6-digit code sent to your inbox.
- Password resets use single-use, expiring reset links, not a password shown in plain text.
Application security
- All account actions (profile updates, applications, connection requests) go through nonce-protected endpoints to guard against cross-site request forgery.
- File uploads (resumes, company logos) are restricted by MIME type and processed through WordPress's media pipeline.
- Form inputs are sanitized and outputs are escaped following WordPress security conventions to guard against injection and cross-site scripting.
Infrastructure
LayoffLink runs on WordPress with a MySQL database. When deployed to production with HTTPS enabled, traffic between your browser and our server is encrypted in transit. We don't publish specific hosting/infrastructure details here, in keeping with normal security practice — email us if you need them for a security review.
Data protection
See our Privacy Policy for what we collect, how long we keep it, and your rights over it.
Vulnerability & incident management
As an early-stage project, we don't yet have a formal bug-bounty program or published incident-response SLA. If something goes wrong, we'll investigate promptly and communicate honestly about impact.
Responsible disclosure
If you've found a security issue, please report it to us directly rather than publicly — we'll treat it seriously and respond as quickly as we can.