Architecture Pillar 1
Defense-in-Depth Infrastructure & Transport Security
DheePath operates on an enterprise cloud infrastructure distributed across Vercel Edge CDN, Render Container Services, and Supabase Cloud PostgreSQL, establishing multi-layered boundary controls:
256-Bit TLS 1.3
All traffic strictly enforces TLS 1.3 encryption with HTTP Strict Transport Security (HSTS) headers and automated HTTPS redirects.
Supabase SSL / PgBouncer
Production PostgreSQL enforces SSL-only connection strings with PgBouncer connection pooling and transaction isolation.
Zero-Trust Render Boundary
Node.js/Express backend runs within isolated Linux micro-containers with strict network egress controls and memory budgets.
Vercel Edge CDN
Static frontend assets and SPA routes are cached across global Edge Points-of-Presence with automated L3/L4 DDoS scrubbing.
Data at Rest Encryption: All database volumes in Supabase are encrypted using industry-standard AES-256 storage encryption. Automated WAL (Write-Ahead Logging) backups are mirrored with point-in-time recovery capabilities to safeguard academic records against hardware loss.
Architecture Pillar 2
Cryptographic Authentication & Role-Based Access Control
Authentication across DheePath eliminates common vector vulnerabilities through cryptographic session tokens, salted password hashing, and strict authorization gates:
- Bcryptjs Salted Password Hashing: User passwords are never saved in plaintext. Credentials are hashed using
bcryptjs with an adaptive work factor of 10 and cryptographically random unique salts per credential.
- Signed JWT Tokens: Sessions are authenticated using JSON Web Tokens (JWT) signed via HMAC-SHA256 with strong runtime secret keys. Tokens encode subject identities, issued timestamps, and role claims with explicit expiration windows.
- Dual-Layer RBAC Enforcers: Access to protected portals is validated on both client and server:
- Client-Side Pre-Render Traps: Inline scripts in
dashboard.html and recruiter-dashboard.html verify session validity before DOM initialization, redirecting unauthorized traffic immediately to login.html.
- Server-Side Express Middleware: REST API endpoints execute
authMiddleware and requireRole(['student', 'recruiter']) verification before resolving database controllers.
// Production Auth Invariant: Zero Plaintext Credential Exposure
Password Storage: bcryptjs.hash(plainTextPassword, saltRounds = 10)
Session Token: jwt.sign({ id, role, email }, JWT_SECRET, { expiresIn: '7d' })
API Guard: router.use('/api/recruiter/*', authMiddleware, requireRole('recruiter'))
Architecture Pillar 3
Recruiter Verification: The 4-Tier Anti-Fraud Gate
To protect student profiles, contact details, and academic portfolios from unverified scrapers and fraudulent agencies, corporate recruiter onboarding is defended by a 4-tier autonomous verification pipeline:
| Tier |
Verification Stage |
Mechanism & Test Vector |
Failure Action |
| Tier 1 |
Disposable & Webmail Blacklist |
Regex & set validation against over 5,000 free webmail and burner domains (gmail.com, yahoo.com, hotmail.com, tempmail.com). |
Immediate 400 rejection: "Corporate work email domain required". |
| Tier 2 |
DNS MX Record Resolution |
Node.js dns.promises.resolveMx() directly queries root nameservers to confirm active Mail Exchange routing records. |
Immediate rejection: Domain cannot receive legitimate email traffic. |
| Tier 3 |
HTTP/HTTPS Live Domain Probing |
Automated head request to https://{company-domain} validating HTTP 200/301 status with SSL certificate validation. |
Flagged as unverified domain: Prevents parked, expired, or synthetic company domains. |
| Tier 4 |
Corporate Work Email OTP |
Cryptographically secure 6-digit one-time password transmitted to the corporate inbox with 10-minute expiry and 3-attempt limit. |
Account creation blocked until live inbox verification is confirmed. |
Only recruiters clearing all four tiers receive the verified corporate badge and access to search the student talent radar.
Architecture Pillar 4
AI Governance, Data Ethics & Client-Side BYOK Isolation
DheePath enforces strict operational boundaries between generative artificial intelligence and student privacy:
Zero Model Training
Candidate resumes, project source code, assessment transcripts, and academic records are NEVER used to train, fine-tune, or calibrate AI models (Groq Llama 3.3, Google Gemini, OpenAI).
Client-Side BYOK Isolation
User-provided API keys stay quarantined solely in browser localStorage. Requests route directly from the client to the model endpoint, never touching DheePath servers.
Deterministic Scoring Boundary: Generative models synthesize qualitative learning modules and natural language career roadmaps. AI models have zero authority over the 60/25/15 mathematical ranking formula, guaranteeing 0% algorithmic hallucination in skill scoring.
Architecture Pillar 5
Document Hygiene & Binary Magic-Byte Inspection
Resume parsing pipelines implement defense-in-depth sanitization to prevent server-side request forgery (SSRF), buffer overflow exploits, and malware distribution:
- Binary Magic-Byte Validation: Uploaded files are inspected for the mandatory PDF magic header bytes (
%PDF- or hex 25 50 44 46) in the raw buffer. Files spoofing extensions (e.g. executable .exe renamed to .pdf) are rejected prior to parser execution.
- Strict Buffer Limits: In-memory file processing is capped at 5 MB per document to prevent memory exhaustion and Denial-of-Service attacks.
- Single Active Resume Invariant: Students maintain exactly one active resume. When an updated PDF is uploaded, the existing file is transactionally deleted from Cloudinary storage, preventing orphaned personal data retention.
Architecture Pillar 6
Weekly Milestone Proctoring & Anti-Cheat Engine
Every weekly milestone test is monitored by automated client-side and server-side proctoring telemetry to certify authentic student mastery:
Server Clock Sync
The 30-minute exam timer is anchored to database-generated timestamps, preventing client-side clock tampering.
Tab Blur Telemetry
Browser visibilitychange and focus events monitor window state. Leaving the active test triggers a recorded infraction.
3-Strike Disqualification
Accumulating 3 strikes terminates the test session with an automated failing score (0%) and invalidates active milestone badges.
Anti-Scrub Video Chamber: YouTube iframe player events are observed via secure postMessage listeners. Students must complete video instruction modules before the corresponding milestone examination is unlocked.
Architecture Pillar 7
The SHA-256 Public Certificate Ledger
Every completed career roadmap culminates in the generation of a cryptographically signed Career Certificate. The certificate record is permanently registered in our public verification registry:
// Certificate Cryptographic Fingerprint Generation
Hash = SHA-256(studentId + careerTrack + completionDate + milestoneScores + SECRET_SALT)
Verification URL: https://disheera.site/verify.html?certId=CP-2026-VRF892
Recruiters can instantly verify credentials by scanning the embedded certificate QR code or entering the Certificate ID on verify.html. Any post-issuance tampering with the student name, score, or track results in immediate cryptographic verification failure.
Architecture Pillar 8
Responsible Vulnerability Disclosure & Bug Bounty Desk
DheePath welcomes ethical security researchers, software engineers, and students who identify potential vulnerabilities in our systems. We are committed to collaborating transparently with researchers acting in good faith.
Security Vulnerability Response Desk
Managed by Parth Patil • Lead Engineer & Security Officer
Safe Harbor Active
Security WhatsApp Hotline
Academic Affiliation
GHRCEM, Jalgaon, Maharashtra, India
Initial Response SLA
24 Hours (Acknowledgment & Severity Assessment)
Remediation Target SLA
Critical: 48 Hours | High/Medium: 7 Business Days
In-Scope Research Vectors:
- Authentication bypasses, JWT signature forgery, or privilege escalation (e.g. Student accessing Recruiter endpoints).
- SQL / NoSQL injection, remote code execution, or server-side request forgery (SSRF).
- Cross-Site Scripting (Stored/Reflected XSS) affecting authenticated user sessions.
- Circumvention of the 4-tier recruiter verification gate or recruiter talent radar access controls.
DPDP Act 2023 Statutory Safeguards & Breach Protocol (Sec 8(5) & 8(6)):
Under Section 8(5) of
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), DheePath implements reasonable security safeguards (TLS 1.3, Supabase AES-256 storage encryption, bcrypt salted hashing) to protect digital personal data. In the event of an identified personal data breach, our incident response protocol mandates prompt intimation to the
Data Protection Board of India (DPBI) and each affected Data Principal in compliance with Section 8(6) without undue delay.
Safe Harbor Commitment: If you conduct vulnerability research in good faith, avoid privacy violations, refrain from destroying data, and give us reasonable time to remediate before public disclosure, we commit not to initiate legal action against you under the IT Act 2000.