What was reviewed.
These notes summarise the original Resume-Enhancer source at commit bc13362 and its portfolio demo review (PR #29). The repository is private. All technical explanations needed for this case study are reproduced here; no private GitHub access is required.
This is a description of code present in the repository, not an independent security audit or verification of a live deployment.
Components and connections.
The worker reads pending records from the same database and source material from the workspace.
Frontend and API
React 18, TypeScript and Vite form the frontend. React Router provides the views, while Axios sends requests to /api with access-token headers and refresh handling. FastAPI mounts routes for authentication, resumes, jobs, enhancements, comparison and career paths.
Records and documents
SQLAlchemy manages database sessions and models, with Alembic migrations. PostgreSQL is the intended database in configuration; SQLite compatibility also exists. Document files and generated output use a configured filesystem workspace. The source does not establish a particular cloud object-storage deployment.
Authentication and ownership
Authentication routes issue access tokens and use an HttpOnly cookie for the refresh token. Backend dependencies validate the access token and resolve the current user. Resume and job routes filter or check records against that user. These are observed controls, not a guarantee that every route is secure.
Document processing and the worker
Resume routes validate uploads, parse text, write workspace files and persist records. A separate worker polls pending enhancements, reads documents, calls Anthropic through messages.create, writes output and updates database state. This is a database-polling process; it should not be described as a verified message-queue architecture.
Optional integrations
Stripe, email and Redis integration code is present. That does not establish that those services were configured or used in production. The exact hosting topology, storage mount, uptime and customer usage cannot be established from source alone.
How the screenshots were produced.
The original React components were rendered from an isolated local demo entry point. Deterministic fixtures supplied fictional users, resumes, jobs, comparison text and enhancement states. External and /api requests were blocked during capture. Every image carries an offline/synthetic-data indicator.
No backend, database, Anthropic service or worker ran during capture. Upload parsing, generation, scoring, exports, payments, email and career-map generation were not reproduced. A seeded completed result is not evidence of a successful AI request, and comparison text was manually authored for the demo.
The case study retains genuine browser captures with captions explaining each state. Each screenshot opens its original full-resolution image.
Source-review inventory.
The review covered frontend/package.json, frontend/src/App.tsx, the frontend API service, backend/main.py, database configuration and models, authentication routes and dependencies, resume and job routes, workspace services, and backend/worker.py. These paths identify what informed the explanation without presenting inaccessible source links as public evidence.