This server is designed to run locally over MCP stdio. Do not expose it to a public network without adding appropriate authentication, authorization, transport security, and a threat model.

• Store real profiles and applications in the directory set by APPLICATION_TRACKER_ROOT.
• Keep that directory outside the Git checkout.
• Treat job descriptions, CVs, letters, interview notes, employment history, email addresses, and phone numbers as private data.
• Review MCP client permissions before connecting a client that can read files or execute commands.

• File paths accepted by the server must be relative to the configured private root.
• The public job discovery tool only calls documented/public ATS endpoints and never auto-applies.
• The TeX compiler runs tectonic with an argument list and a fixed working directory; it does not invoke a shell.
• Generated documents are drafts. The user must check every factual claim before use.

Do not include private applicant data in public issue reports. Use GitHub private security reporting if the repository enables it, or contact the maintainer through the repository's security contact.