Resume, Portfolio & GitHub Profile Module 10 – AI, privacy and integrity
What not to publish: privacy for job seekers
What to keep off a public resume, profile and portfolio: identity numbers, hidden PDF and photo metadata, commit e-mails, keys and other people's data.
What you will learn
- Remove identity numbers, birth dates, home addresses and bank details from resumes, profiles and repositories
- Inspect and remove hidden metadata in PDFs and photos before you share them
- Protect other people's data in screenshots, datasets and case studies
- Find and reduce your contact details in search results
Before you start
What you’ll learn · Before you start
What you will learn
- Remove identity numbers, birth dates, home addresses and bank details from resumes, profiles and repositories
- Inspect and remove hidden metadata in PDFs and photos before you share them
- Protect other people's data in screenshots, datasets and case studies
- Find and reduce your contact details in search results
Before you start
On this page
A resume made from an old employer’s template can still name that employer in its author field years after you left. Asha’s did, and it also held two dates with her time zone, none of it visible on the page.
This lesson goes through what a job seeker publishes, what each item can carry besides what it shows, and how to check it before it goes out: the resume, its hidden fields, a photo’s position, a repository’s history and other people’s data in a case study.
A public resume needs your city and one way to reach you
A resume, profile or portfolio site that anyone can read needs your name, your city, one or two ways to reach you and links to your work, and nothing that lets a stranger impersonate you or find your door. LinkedIn’s job-safety page lists national ID numbers, bank or card details and passport or licence copies as things to keep private until a legitimate offer. Keep these off anything public:
| Leave it off | Why |
|---|---|
| Identity numbers and document copies | They are what an impersonator needs |
| Date of birth | With your name, it identifies you to strangers |
| Full home address | Your city is enough for a recruiter |
| Bank or card details | Payroll needs them after you join, never before |
Aadhaar and PAN on a resume
Treat an Aadhaar number, a PAN and a passport number as national ID numbers: none is needed on a resume or a profile, so none goes there.
Files carry details you never typed
A PDF stores fields about itself, its PDF metadata: The fields a PDF stores about itself, such as its title, author, the software that made it and the dates it was made and changed, in its document information and often again in an XMP packet.: a title, an author, the software that made it and the dates it was made and changed. A photo from a phone can carry Exif data: Information a camera or phone writes into a photo file, such as the camera model, the time and, when location is on, the GPS position of the place the photo was taken. with the GPS position of the place it was taken. Anyone who receives the file can read them. The program writes Asha’s template-made resume and reads it with Poppler’s pdfinfo, as a recipient would:
# What a PDF says about itself. Asha, the invented engineer of this track, made her resume from a template she kept
# from her internship; the program writes that file by hand, with the document information and the XMP metadata such
# a template carries, and reads them back with poppler's pdfinfo 26.09.0 (Homebrew: brew install poppler), as anyone
# who receives the file can. -isodates prints the dates as stored, with the time zone of the computer that made them.
# The employer, the template software and every value are invented. A pdfinfo of another version stops the run.
import re
import shutil
import subprocess
import sys
POPPLER = "26.09.0"
PATH = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
FIELDS = ("Title", "Author", "Creator", "Producer", "CreationDate", "ModDate", "Metadata Stream")
XMP = (
b'<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?><x:xmpmeta xmlns:x="adobe:ns:meta/">'
b'<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="" '
b'xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmp="http://ns.adobe.com/xap/1.0/">'
b"<dc:creator><rdf:Seq><rdf:li>Orbit Analytics HR</rdf:li></rdf:Seq></dc:creator>"
b"<xmp:CreatorTool>TemplateKit 3.2</xmp:CreatorTool></rdf:Description></rdf:RDF></x:xmpmeta>"
b'<?xpacket end="w"?>'
)
INFO = (
b"<< /Title (Orbit Analytics CV template) /Author (Orbit Analytics HR) /Creator (TemplateKit 3.2) "
b"/Producer (TemplateKit PDF 3.2) /CreationDate (D:20190304101500+05'30') /ModDate (D:20210611183000+05'30') >>"
)
def pdfinfo():
found = shutil.which("pdfinfo", path=PATH)
if not found:
sys.exit("pdfinfo was not found")
out = subprocess.run([found, "-v"], capture_output=True, text=True)
version = re.search(r"pdfinfo version (\S+)", out.stdout + out.stderr)
if not version or version.group(1) != POPPLER:
sys.exit(f"this run needs pdfinfo {POPPLER}, found: {(out.stdout + out.stderr).strip().splitlines()[0]}")
return found
def resume_pdf(path):
"""One page with Asha's name, plus the template's document information and XMP packet."""
content = b"BT /F1 16 Tf 72 780 Td (Asha Verma) Tj ET"
objects = [
b"<< /Type /Catalog /Pages 2 0 R /Metadata 6 0 R >>",
b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>",
b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
b"<< /Length %d >>\nstream\n" % len(content) + content + b"\nendstream",
b"<< /Type /Metadata /Subtype /XML /Length %d >>\nstream\n" % len(XMP) + XMP + b"\nendstream",
INFO,
]
pdf, offsets = b"%PDF-1.7\n", []
for n, body in enumerate(objects, start=1):
offsets.append(len(pdf))
pdf += b"%d 0 obj\n" % n + body + b"\nendobj\n"
xref = len(pdf)
pdf += b"xref\n0 %d\n0000000000 65535 f \n" % (len(objects) + 1)
pdf += b"".join(b"%010d 00000 n \n" % o for o in offsets)
pdf += b"trailer\n<< /Size %d /Root 1 0 R /Info 7 0 R >>\nstartxref\n%d\n%%%%EOF\n" % (len(objects) + 1, xref)
with open(path, "wb") as f:
f.write(pdf)
tool = pdfinfo()
resume_pdf("asha-verma-resume.pdf")
info = subprocess.run([tool, "-isodates", "asha-verma-resume.pdf"], capture_output=True, text=True, check=True).stdout
print(f"$ pdfinfo -isodates asha-verma-resume.pdf (poppler {POPPLER}; the fields that describe the file)")
for line in info.splitlines():
if line.split(":")[0].strip() in FIELDS:
print(f" {line}")
xmp = subprocess.run([tool, "-meta", "asha-verma-resume.pdf"], capture_output=True, text=True, check=True).stdout
print()
print("$ pdfinfo -meta asha-verma-resume.pdf (the XMP packet, its two readable values)")
for tag in ("rdf:li", "xmp:CreatorTool"):
value = re.search(rf"<{tag}>([^<]*)</{tag}>", xmp)
print(f" {tag}: {value.group(1) if value else '(none)'}")Output
$ pdfinfo -isodates asha-verma-resume.pdf (poppler 26.09.0; the fields that describe the file) Title: Orbit Analytics CV template Author: Orbit Analytics HR Creator: TemplateKit 3.2 Producer: TemplateKit PDF 3.2 CreationDate: 2019-03-04T10:15:00+05:30 ModDate: 2021-06-11T18:30:00+05:30 Metadata Stream: yes $ pdfinfo -meta asha-verma-resume.pdf (the XMP packet, its two readable values) rdf:li: Orbit Analytics HR xmp:CreatorTool: TemplateKit 3.2
Recorded with Python 3.14.8 on macOS 26 arm64. To run it yourself: mise exec python@3.14.8 -- python3 template_metadata.py
Her file names “Orbit Analytics HR” as its author twice, in the document information and in its XMP packet, gives the template’s software, and dates itself with the +05:30 offset of Indian time. Before sending a file, remove all metadata with MySmartCoPilot’s PDF Metadata Viewer, which writes a clean copy, and check the copy; for photos, the Image Metadata Viewer strips Exif data.
PDF Metadata Viewer & Editor See every field and the XMP packet of a PDF, then remove all metadata in a clean copy.Checkpoint
Check: What stays off a public resume · Hidden fields in PDFs and photos
A public repository shows its whole history
GitHub warns that anything you add to a public profile is visible to all GitHub users, including in regions where local laws or cultural norms may make expressing your identity risky. A repository goes further: it is its whole history. Step through four things Asha is about to publish, her repository among them:
The drawing shows the whole scene; its 6 steps are listed below.
Every step as text
- Four things to publish. Asha is about to send her resume, update her profile photo, make a project repository public and post a case study with a screenshot. Each shows what she meant to show; each can carry more.
- The resume PDF. A PDF stores fields about itself: a title, an author, the software that made it and the dates, with a time zone. Hers came from an old employer's template, so its author field still names that employer.
- The photo. A phone camera can write the GPS position of every photo into its Exif data. A photo taken at home and uploaded as it is can carry the coordinates of the home.
- The repository. A public repository is its whole history, not only today's files. The e-mail address of every past commit, and a .env file she deleted later, are still there for anyone with a clone.
- The screenshot. Her dashboard screenshot shows real users' names and phone numbers in a table. They are other people's personal data, and they are not hers to publish.
- Check before you publish. Each of the four can be checked before it goes out: the PDF's fields, the photo's Exif data, the repository's history and the screenshot's content. The sections below take them one at a time.
The e-mail address of each commit is part of the commit, and GitHub says commits made before you change your
commit address stay associated with the old one. Commit with GitHub’s
noreply e-mail address: An address GitHub gives each account for commits, of the form ID+USERNAME@users.noreply.github.com, so that commits do not show your personal e-mail address., and its setting to block command-line pushes that would expose your
private address catches the rest. Keep .env files out of Git, and treat any key that reached a public commit as
exposed: OWASP’s guidance is that exposed keys are revoked immediately.
Search results can show your contact details
Search your own name the way a recruiter would, then look at what the results show. Google’s Results about you finds results that show your home address, phone number or e-mail address, and lets you request their removal; once it is set up, it can tell you when new ones appear. A removal takes the result out of Google Search. Google says the information still exists on the source page, so ask that site’s owner to remove it there too, starting with old profiles and resume uploads you no longer use. Step through one clean-up:
The drawing shows the whole scene; its 5 steps are listed below.
Every step as text
- Search your name. Start where a recruiter starts: a search for your name, alone and with your city or college. Note every result that shows a home address, a phone number or a personal e-mail address.
- Results about you. Google's Results about you finds results that show your home address, phone number or e-mail address, and can notify you when new ones appear.
- Request removal. Request removal of each result. Usually the page then appears for no search at all; sometimes it is kept out only of searches that contain your name.
- The page itself. Google says the information still exists on the source page. Ask that site's owner to take it down, starting with old profiles and resume uploads you no longer use.
- Search again. Repeat the search when a job hunt ends, before the profiles you made for it are forgotten.
The two requests together take the details out of the search and off the page.
Checkpoint
Check: A repository's history and keys · Your details in search results
Wiping a PDF and a photo: three wipes measured, one that holds Pro: opens with a Pro, Premium or Ultimate pass
A wipe can look clean in a viewer and still hold the old values inside the file. This part measures three ways to wipe Asha’s PDF and one way to clean her profile photo, and checks each result the way a recipient would.
In this part:
- Three wipes of the same PDF, and what each one left
- A photo’s position, read and removed
2 runnable examples (Python) · about 4 minutes
Opening this part with your pass…
This part opens with any MySmartCoPilot pass.
- Pro pass · 1 week₹79$2.99
- 30 days₹179$5.99
- 1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so this part can’t be opened at the moment. The free part above stands on its own. If you have a pass, enter your licence key.
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
What a public repository gives away, reproduced Pro: opens with a Pro, Premium or Ultimate pass
A repository published once is public with its whole history. This part reproduces two leaks in a real Git history, a personal e-mail address and a deleted key, and puts the fixes in the order that limits the damage.
In this part:
- A personal address and a deleted key, still in the history
- The fixes, in the order that limits the damage
1 runnable example (Python) · about 3 minutes
Opening this part with your pass…Pro part. It opens with the same pass as the part above.
Other people's data in screenshots, datasets and case studies Pro: opens with a Pro, Premium or Ultimate pass
A portfolio case study is often built on other people’s data: a dashboard’s users, a form’s answers, a team’s chat. This part works through a dataset with a program that keeps only what the case study needs, and a screenshot with the text that describes it.
In this part:
- A survey dataset, reduced to what the case study needs
- A screenshot with the people taken out
1 runnable example (Python) · about 4 minutes
Opening this part with your pass…Pro part. It opens with the same pass as the part above.
Practise: find the leaks in a portfolio
Asha’s portfolio bundle hides eight problems, from a .env file to a GPS position; write the check that finds them:
Exercise · Medium · Python
Find the eight leaks in a portfolio before it goes public
Asha is about to make her portfolio public. The tests hand your function her bundle as a dictionary from file names to their text: a README, a .env file, her commit log, her resume as text, what pdfinfo printed for her resume PDF, and what exiftool printed for her profile photo. It hides eight problems.
Write leaks(files), which returns a sorted list of (file name, problem) pairs, using these problem names:
"env file": a file whose name ends in.env;"phone number": a run of digits, spaces and hyphens with at least ten digits;"personal e-mail": an e-mail address that is not a GitHub noreply address (ending in@users.noreply.github.com);"date of birth": a line that mentions a date of birth;"home address": a line that starts withAddress:;"ID number": a 12-digit number, with or without spaces between groups of four, or a tax ID of five capital letters, four digits and one capital letter;"metadata author": anAuthor:line whose name is notAsha Verma;"GPS position": a line that holds a GPS position.
The sample tests check that all eight are found, that a clean bundle gives no problems, and that the numbers of her work are not mistaken for phone numbers.
Starter code · leaks.py
# Find what Asha's portfolio would give away, by the rules of the prompt.
import re
NAME = "Asha Verma"
def leaks(files):
"""Return a sorted list of (file name, problem) pairs for a portfolio about to go public."""
return []The sample tests · test_leaks.py
from leaks import leaks
BUNDLE = {
"README.md": "# Weather card\nBuilt by Asha Verma. Questions? Call +91 01234 56789.\n",
".env": "WEATHER_API_KEY=lesson-demo-0000-not-a-real-key\n",
"commits.txt": (
"1b05903 Asha Verma <asha.verma.home@example.com> First version of the weather card\n"
"ea62d91 Asha Verma <12345678+asha-example@users.noreply.github.com> Add a README\n"
),
"resume.txt": "Asha Verma\nAddress: Flat 12, Banyan Court, Bengaluru\nDate of birth: 14/03/1999\nPAN: ABCDE1234F\n",
"resume-pdfinfo.txt": "Title: Orbit Analytics CV template\nAuthor: Orbit Analytics HR\n",
"photo-exiftool.txt": "GPS Position: 12.9763 77.5929\nImage Size: 800x800\n",
}
EXPECTED = [
(".env", "env file"),
("README.md", "phone number"),
("commits.txt", "personal e-mail"),
("photo-exiftool.txt", "GPS position"),
("resume-pdfinfo.txt", "metadata author"),
("resume.txt", "ID number"),
("resume.txt", "date of birth"),
("resume.txt", "home address"),
]
CLEAN = {
"README.md": "# Weather card\nBuilt by Asha Verma. Moved 14 services in 2024; handles 2,000,000 events a day.\n",
"commits.txt": "ea62d91 Asha Verma <12345678+asha-example@users.noreply.github.com> Add a README\n",
"resume.txt": "Asha Verma\nBengaluru\nCut p95 API latency from 420 ms to 180 ms.\n",
"resume-pdfinfo.txt": "Title: Asha Verma, resume\nAuthor: Asha Verma\n",
"photo-exiftool.txt": "Image Size: 800x800\n",
}
def test_finds_all_eight():
"""finds the eight problems of the bundle, and nothing else"""
found = leaks(BUNDLE)
missing = [p for p in EXPECTED if p not in found]
extra = [p for p in found if p not in EXPECTED]
assert not missing, f"not found: {missing}"
assert not extra, f"reported but not a problem: {extra}"
assert found == sorted(found), "return the pairs sorted"
def test_clean_bundle():
"""a clean bundle has no problems"""
assert leaks(CLEAN) == [], f"a clean bundle reported {leaks(CLEAN)}"
def test_work_numbers_are_not_phones():
"""the numbers of the work are not phone numbers"""
text = {"notes.md": "Raised coverage from 48 % to 81 % with 140 tests; 2,000,000 events; 420 ms to 180 ms."}
assert leaks(text) == [], f"reported {leaks(text)} for numbers of the work"A hint
Loop over the files and test each rule on each file's text, appending (name, problem) when it matches. Count the digits of a run before you call it a phone number, and look for ID numbers with their own pattern, because a 12-digit ID number also has more than ten digits. Return sorted(found) so the order never matters.
Results of the sample tests
| Test | Result | Details |
|---|
What your code printed
The sample tests run on this device, in your browser (Pyodide): nothing is sent to mysmartcopilot.com. The first run downloads Python (about 13.5 MB), which is kept for the next runs. A check in your browser is feedback for you, not proof that the code is right for every input.
Then test yourself on identifiers, file metadata, repositories and search results; the questions start with your weakest one:
Practice that adapts to you
Practise this lesson
11 questions about 7 ideas of this lesson. Each answer is explained at once, and what you get right is kept in this browser.
Interview questions
Warm-up (fresher to mid-level): What personal details should a resume leave out?
Anything a stranger could use to impersonate me or find my home: identity numbers such as a national ID or passport number, my date of birth, my full address and any bank details. A public resume needs my name, my city, an e-mail or phone number and links to my work. The details I leave out are ones employers need only after an offer, through their own forms. I also check the file itself before I send it, because a PDF can name its author and dates in fields the page does not show.
Three questions of this module’s bank go further:
-
Fresher to mid
You sent a resume PDF built from a template you kept from a previous job. A recruiter mentions that the file's properties name your old employer's HR team. What happened, how do you fix the file, and how do you prove that the fixed file is clean?
-
Fresher to senior
Your portfolio repository has been public for a month, and you notice that its first commit added a .env file with a working API key. You deleted the file in the next commit. What do you do now, in which order, and why?
-
Fresher to mid
The dashboard you built in your internship is your best portfolio piece, but its screenshots and data show the company's real customers. How do you present it in a public case study, and what do you ask first?
Flashcards · 7 cards
Recall it, then check
Say the answer to yourself before you look: recalling it is what makes it stick.
-
What does a public resume or profile need, and what never goes on it?
Your name, your city, one or two ways to reach you and links to your work. Never identity numbers or copies of documents, a date of birth, a full home address or bank details.
-
Why keep identity numbers and a date of birth off anything public?
Identity numbers and document copies are what an impersonator needs, and a date of birth together with your name identifies you to strangers. Employers who need them ask through their own forms after an offer.
-
What can a PDF tell a recipient about itself that its page does not show?
Its metadata: a title, an author, the software that made it and when it was made and changed, sometimes twice, in the document information and in an XMP packet. A resume built on an old employer's template can still name that employer as its author.
-
What can a phone photo carry that you never typed?
Exif data, including the GPS position of the place it was taken when location is switched on. Strip it before you publish or send the photo.
-
Why does changing your commit e-mail address leave old commits as they were?
The address is part of each commit, and commits made before the change stay tied to the old one. Commit with GitHub's noreply address from the start, and turn on blocking pushes that would expose your private address.
-
A key reached a public commit. What should you do?
Treat it as exposed and revoke it at once, as OWASP's guidance says, and keep .env files out of Git so that it cannot happen again.
-
How do you get your phone number or address out of Google's results?
Google's “Results about you” finds results that show your home address, phone number or e-mail address and lets you ask for their removal from Search. The details stay on the source page, so ask that site's owner to remove them there too.
Key takeaways
- A public resume or profile needs your name, city, a way to reach you and links to your work, never identity numbers, a date of birth, a home address or bank details.
- PDFs carry an author, software and dates, and photos can carry a GPS position, which every recipient can read.
- A public repository is its whole history: commit with a noreply address, keep
.envfiles out, and revoke any key that reached a commit. - Results that show your address, phone or e-mail can be removed from Google Search; the source page needs its own request.
Terms in this lesson
- Exif data
- Information a camera or phone writes into a photo file, such as the camera model, the time and, when location is on, the GPS position of the place the photo was taken.
- noreply e-mail address
- An address GitHub gives each account for commits, of the form ID+USERNAME@users.noreply.github.com, so that commits do not show your personal e-mail address.
- PDF metadata
- The fields a PDF stores about itself, such as its title, author, the software that made it and the dates it was made and changed, in its document information and often again in an XMP packet.
- pseudonymisation
- Replacing the names and other direct identifiers in data with labels, such as Respondent 1. Whoever holds the original can still match the labels back, so it is not the same as anonymity.
References
- Search for jobs confidently and safely (LinkedIn Help)
- Profile reference (GitHub Docs)
- Setting your commit email address (GitHub Docs)
- Email addresses reference (GitHub Docs)
- Blocking command line pushes that expose your personal email address (GitHub Docs)
- Removing sensitive data from a repository (GitHub Docs)
- Secrets Management Cheat Sheet (OWASP Cheat Sheet Series)
- Find and remove personal info in Google Search results (Google Search Help)
- Government notifies DPDP Rules to empower citizens and protect privacy (Press Information Bureau, Government of India)
- GPS Tags (ExifTool by Phil Harvey)
- Poppler (freedesktop.org)
- Running qpdf (qpdf)
- PDF Tags (ExifTool by Phil Harvey)
Related tools
Report a problem with this lesson
Kept only in this browser. Your Learn progress