Privacy: Set authentication globally and/or per CV slug

[rorar]

Hi!
It would be great to have authentication that can be enabled globally and also overridden per CV/slug.

This would help in cases like:

• limiting access only to the people who need it (HR and Recruiters); Avoid aggressive scanning by AI providers and data collectors
• keeping some CVs private, especially when you do not want other companies to know you are also exploring other opportunities

Having both a global setting and per-slug control would make the feature flexible and useful for different workflows.

Usecase:

• A user is sharing a CV over Social Media (LinkedIn, XING,...)
• A user is visiting a career fair and shares the CV over a link/qr code
  ... alongside with a password

[vincentmakes]

I don't see a practical use case in reality and that adds complexity + attack surface so it's unlikely I'll add that to the roadmap.

[rorar]

Yes, if there's no authentication at all and doors are wide open, there's no attack surface. *wink wink*
"Attacking" isn't just gaining access to backends, it's also social engineering and data mining.
Example: Find my CV online -> CV tells attacker that I'm a valuable target -> Call current/old employer -> "I've found rorar's expensive watch with rorar's name engraved, mind sharing his contact info?" -> Send pishing link -> gain access over my live and/or to the current company.
So I'd like to keep my data at least a little private and protected. And a password might help.

As mentioned: Currently, any CV with a public URL is accessible to anyone. This is great for easy sharing, but problematic when you want control over who sees your CV:

Scenario	Without Protection	With Protection
Published as Website	AI scrapers index your CV automatically and data mine for more information	Only humans with password see it
Career fair	Loose a business card with an link/scanable QR code to my CV = data is out of my control	Only recruiters I talked to with a password to my CV gain access
Secret job search	Current employer might find it	Discreet - hiring companies only see it if you share password
Sensitive roles	Competitors see your targets and might decide against you	Confidential until you choose to share

[vincentmakes]

That's no what I meant: by design this app is supposed to be self hosted into two containers: one local, one exposed to the internet via tunnel.
The one exposed to the internet is specifically built to be read only and ultra simple (basically a static site).
Regardless, this is not a feature I can see would add value but as I mentioned before: this app is under MIT license so feel free to build your own version out of it if it adds value to you :-)