Scope and method
The review covered the public Pages deployment, checkout and employer API Worker, job API Worker, attribution edge Worker, Stripe catalog and fulfillment design, Cloudflare bindings, the production D1 schema and entitlement rows, public links, response headers, browser console behavior, and published promises. Testing was defensive and non-destructive. Secrets were checked by binding name and presence; secret values are not published.
Initial findings and release treatment
| Initial risk | Finding | Release-candidate treatment |
|---|---|---|
| Critical | Anonymous internal fulfillment route could mint credentials. | Route now requires a dedicated internal API secret and remains idempotent by payment/session identifier. |
| Critical | Anonymous lookup route could disclose a credential from an email address. | Route now requires the internal API secret. Public recovery uses a generic response and expiring emailed link. |
| High | Webhook processing could mark events complete before fulfillment and did not reconcile the full payment lifecycle. | Signed requests use a five-minute replay window and constant-time comparison. Events have processing, retry, completion, and failure state. Success, asynchronous success/failure, refunds, disputes, subscription changes, and invoice status are handled. |
| High | Employer passwords used an unsalted fast hash and authentication accepted weak token transport/fallback behavior. | New passwords use salted PBKDF2-SHA-256 with the Cloudflare runtime maximum of 100,000 iterations; legacy hashes upgrade after successful login. Tokens require the dedicated secret, expire after one hour, use the Authorization header, and are rate limited. |
| High | Existing paid access durations did not meet the published three-year benefit. | The release migration extends active credential verification and job access to at least three years from original creation and keeps distinct expiry fields. |
| Medium | Employer job, billing, inquiry, and recovery paths were missing or displayed unverified success. | Server-side routes, durable records, quota enforcement, provider response checks, and error states are implemented in production. A controlled inquiry returned 201, both provider calls were accepted, and D1 recorded notified before labeled test-data cleanup. |
| Medium | HTTP, duplicated policy headers, broken internal links, and obsolete affiliate loading weakened the public boundary. | Production redirects HTTP to HTTPS, emits one normalized policy, removes obsolete loading, and passes the local internal-link and script-syntax gate. |
Verified release controls
- Hosted Stripe Checkout and Customer Portal are used; the application does not collect card numbers.
- Production and release schemas were backed up and the migration was tested against a copy before remote application.
- Credential fulfillment uses cryptographically generated identifiers, unique payment/session constraints, and retry-safe event processing.
- Public verification minimizes identity output; employer actions require short-lived authenticated sessions and organization-scoped queries.
- Cross-origin access is limited to the Real World Careers production and preview origins; hostile origins are rejected.
- Secrets remain in Cloudflare secret bindings and are not embedded in the public site or source report.
- Release files are checked for broken internal targets, duplicate IDs, inline-script syntax, obsolete entitlement language, and unsupported federal claims.
Open risks and external gates
| Open item | Required before relying on stronger assurance |
|---|---|
| Independent security assurance | Commission a scoped third-party penetration test, remediate findings, and retain a signed report before representing independent assurance. |
| Federal production authorization | Agency security review, control mapping, data categorization, records terms, incident procedures, and an authority to operate remain engagement-specific gates. The service is not FedRAMP Authorized. |
| Credential and job-access identifier | Legacy users still use the credential identifier to begin job access. It should be treated as shareable only with intended verifiers; a separate candidate authentication factor is a planned defense-in-depth improvement. |
| Accessibility assurance | The vendor draft ACR reports partial support. Manual assistive-technology testing and an independent review remain open. |
| Operational history | New employer subscription, billing, direct-opening, and lifecycle paths require continued production monitoring; deployment verification is not a substitute for operating history. |
Release status
Production status: promoted and defensively retested July 24, 2026. The tested base Cloudflare Pages deployment 8396c008 (followed by report-only publication); checkout Worker d1a3c337-b3b8-4712-929e-16e87535db95; transactional email Worker 0cd3be81-49ed-4d4f-8305-4dd6817c5b3d; jobs Worker da7c2b41-7dd9-46eb-835d-1c62a347b7c8; Stripe router a26414b5-47a9-4d55-94ba-b2b4dbdd993a; edge Worker f3d6f859-3532-4a9b-97d9-19b0c4cf34ef. Post-release checks covered 14 desktop routes, five mobile routes, 50 crawled page variants, 952 link/resource occurrences, API authorization and validation contracts, HTTPS/CSP/CORS headers, and the 75-record entitlement backfill. Home, employer, and federal entry pages each scored 100 for Lighthouse performance, accessibility, best practices, and SEO. These results are dated vendor evidence, not independent certification or a guarantee against future vulnerabilities.
Reporting
Report a suspected vulnerability to security@advancedlearning.academy. Do not access other users’ information, interrupt service, or perform destructive testing. See security.txt for the published contact and policy window.