Account sign-in and security
Sign-in methods, what we record about your sessions, how lockout works, and what to do if you can't get in.
Accounts are for developers using the API. There are no candidate accounts, no CVs, and nothing to apply to — see what HyperJobs is.
Signing in#
Two methods, both through Firebase Authentication:
- Email and password
- Google sign-in
Use whichever you registered with. If you signed up with Google, there's no password on the account to reset — sign in with Google.
Password resets go to the address on the account, from the sign-in page. If the email doesn't arrive, check spam before writing to us; we can't read the reset link out to you.
Disposable-email domains are rejected at signup, and there are limits on how many accounts one IP can create — 3 per hour and 10 per 30 days. These exist to stop bulk account farming. Shared office and campus IPs are the reason the 30-day number is generous rather than tight, but if you're legitimately blocked by it, write to [email protected].
Account lockout#
Repeated failed sign-ins lock the account, progressively:
| Failed attempts | Locked for |
|---|---|
| 5 | 15 minutes |
| 10 | 1 hour |
| 20 | 24 hours |
Lockout is keyed to the account, and it's time-based — it clears on its own. There is nothing to unlock and no one to ask; wait it out. If you've forgotten the password, reset it rather than burning attempts.
Lockout doesn't touch your API keys
Being locked out of the dashboard has no effect on your API keys. They keep serving requests throughout — key auth and account sign-in are separate systems. A lockout is not an outage.
Sessions#
We record a session when you sign in, and show it on your account so you can see where you're signed in. Each session carries:
- Browser and operating system
- IP address
- Coarse location — city, region, country, derived from the IP
That's device-level detail, not tracking. It's there so an unfamiliar entry is visible to you, which is the only reliable way you'd notice someone else in your account.
Sign-in and account events are also written to an append-only audit log, retained for 365 days. The privacy policy has the full table of what we collect and how long we keep it — including the device fingerprint and signup IP, which exist for abuse prevention and are documented rather than hidden.
If you think someone's in your account#
Change your password
Or, on a Google account, secure the Google account — that's the credential.
Check your sessions
An IP or city you don't recognise is the signal.
Revoke every API key you don't recognise
Keys are the part with commercial consequences: they spend your quota. See if a key leaks.
Check your usage
The dashboard shows a 30-day daily breakdown per key. Volume you can't account for is what a stolen key looks like.
Then tell us at [email protected].
What an attacker could actually do#
Worth being precise, because it's narrower than you might assume. The API is
read-only: there are no POST, PUT or DELETE routes. Someone with your key
can read job data and spend your quota. They cannot modify your data, and they
cannot reach your billing — card details live with Stripe and we never hold them.
Someone with your account password is a bigger problem: they could create keys and open the Stripe portal. That's why the password matters more than the key does.
Reporting a vulnerability#
Write to [email protected]. Security testing against the API requires written permission in advance — see §7 of the terms — and please give us reasonable time to fix an issue before disclosing it.
Next#
Rotation without downtime.
Deleting your accountWhat deletion does, and what survives it.