Enhanced security and privacy hardening

• Default on

Who: Customer Admins, Security Engineers, DevOps

What's new: 

• Consistent Object Access Validation: Strict validation of Object Level Authorization across Interview Feedback, Resume Download, Candidate Profile, Core Data API, and Public Events API endpoints with server-side RBAC validation making it consistent with existing front-end behavior

• XSS prevention: Added DOM-based XSS sanitization in candidate profiles and work experience fields with context-aware HTML encoding

• File security: Deployed malicious file detection with PDF/EXIF metadata scanning and multi-stage binary inspection

• Privacy controls: Stricter contact consent validation on profile sharing, and reduced client-side boot data payload

• Talent Acquisition security updates:

  • Added authorization checks across endpoints to prevent unauthorized position cloning, audit trail access, Planned Event details viewing, Interview Feedback management, and business unit data exposure via T2 filters. Restricted community list page access for lower-privileged users

  • Sanitized user input in profile descriptions and account pages before database storage and UI display to prevent malicious JavaScript injection on global search page

• Talent Management security updates:

  • Restricted profile viewing, editing, skill suggestions, notifications, language details, skill endorsements, and resume access to profile owners and explicitly authorized users. Applied role-based API restrictions to block candidates from employee data and implemented rate limiting to prevent bulk downloads

  • Removed hidden profile section data from backend APIs and applied visibility rules to all profile links. Honored language preferences in Mentorship Highlights, filtered notification settings and marketplace features based on permissions, and updated profile visibility messaging to clarify manager and HR access rights