How Jobiba protects your account and files

• HTTPS only. Responses tell browsers to use HTTPS for jobiba.com and its subdomains (HTTP Strict Transport Security), so a browser that has visited once will not fall back to an unencrypted connection.
• Browser safeguards. Pages cannot be framed by other sites, browsers are told not to guess file types, and links to other sites do not pass on the page you were on.
• Cloudflare in front. All traffic passes through Cloudflare, which applies its managed firewall rules, limits how many requests one address can send, blocks known vulnerability scanners and challenges traffic that looks automated.

• Sign-up, sign-in and password-reset forms run a Cloudflare Turnstile check to stop automated sign-ups and password guessing. If Cloudflare's check service is down, the forms keep working rather than lock everyone out.
• Passwords need at least 8 characters and are stored only as scrypt hashes (Better Auth); Jobiba staff cannot read them. You can also sign in with Google or LinkedIn and never set a Jobiba password.
• Resetting your password signs out your other sessions, and changing it in Account settings needs your current password.
• Jobiba never asks for your password or a sign-in code by email, phone or chat.

• Resumes, profile photos and the application PDFs made when you apply are kept in private cloud object storage. A direct link to the storage bucket is refused; Jobiba reads the files with its own credentials when you, or an employer you applied to, open them.
• Uploads go straight to storage through a signed link that expires after 5 minutes and accepts only an allowed file type (resumes: document formats; photos: JPEG, PNG or WebP).
• Only company logos and company photos that an employer attached to its own profile are public.

• The admin console uses its own accounts, separate from public Jobiba accounts, with bcrypt-hashed passwords and a Turnstile check at login.
• An admin sign-in creates a random session token stored on the server and sent in a cookie; it expires after 8 hours.

Signed-in job seekers can download a copy of their data and delete their account in Account settings; employers request deletion there. What is deleted and what is kept is listed in the Privacy Policy. Privacy questions go to Bhagwati Suthar, Privacy and Grievance Officer, bhagwati@jobiba.com.

Email

info@jobiba.com

security.txt

https://jobiba.com/.well-known/security.txt

Describe what you found and how to reproduce it. Do not access other people's data, run denial-of-service tests or send spam. Jobiba has no paid bug bounty. Suspicious job posts are a different matter: report them on Trust & Safety.

No website is free of risk, and Jobiba does not claim a certification, a third-party audit or zero incidents. Jobiba does not confirm employer identities by document, so the advice on Trust & Safety still applies: never pay to apply and never share bank details or codes.