How HireDec. checks every uploaded file

Hiring means opening files from strangers. A company opens a candidate’s CV; a candidate opens a company’s assignment brief. Documents can carry more than text: macros, scripts, embedded files, or links that load content from elsewhere when they’re opened. Pictures can be crafted to exploit the software that displays them.

So HireDec. checks every file before it’s stored, and serves files in a way that means a browser never runs them. Rather than writing our own detection, we rely on established open-source tools that do this job well.

What happens to a file you upload

1. We find out what it really is. The file’s type comes from its content, never from its name. A file whose content doesn’t match its name is refused, and so is any kind we don’t accept.
2. It’s scanned for malware with ClamAV.
3. Documents are checked for active content. Office files go through oletools, which finds macros, DDE fields and remote templates. PDFs are read strictly by qpdf and PDFiD, which report scripts, attachments and launch actions. A document with any of these is refused, with a plain explanation.
4. Pictures are rebuilt from their pixels by Pillow: profile photos and company logos are redrawn as a new image, so nothing hidden in the original file survives. SVG logos are cleaned with DOMPurify.
5. Files are stored under random names, and every download checks, each time, that you’re allowed to see it.
6. Files are served so they can’t run. A fixed content type, and a policy that lets nothing in the file execute.

And when a document goes from one side to the other, like a CV to a company or an assignment brief to a candidate, the other side can open a safe copy made with Dangerzone: the document converted to pixels and back to a clean PDF, in an isolated sandbox.

What this means for you

• PDF and Word files work, both .docx and the older .doc, as do Excel, PowerPoint, ZIP, images (PNG, JPG, WebP) and plain text.
• Documents with macros, embedded objects or remote templates are refused. Most CVs and briefs never contain them. If yours is refused, exporting it to PDF usually solves it.
• Password-protected files can’t be checked, so upload an unprotected copy.
• If a file can’t be checked at that moment, for example while a scanner restarts, the upload is refused rather than let through, and you can try again a minute later.

Want the full picture of how HireDec. keeps each side’s data private? Read about security and privacy.