Cleared2Hire: AI hiring platform for cleared talent

A hiring platform for roles that need a security clearance. Employers submit a role and get one to three evaluated candidates instead of a stack of resumes. I co-own the company and built and run the platform as CTO.

Matching runs in two stages. A deterministic filter first narrows candidates on the hard requirements, such as clearance level and location. Claude then ranks the remaining candidates and writes out the reasoning behind each match, so the employer sees why a candidate was recommended, not just a score.

The users are cleared professionals, so the data is sensitive by definition. Before launch an outside architect reviewed the platform in three phases: a static code and architecture pass, a live pass with adversarial testing, and a penetration test. It catalogued 117 findings.

What I built to handle it:

A remediation ledger in the repo. Every finding has an ID, a state, and the evidence that closed it, so there is always one answer to what is still open.

Runbooks for risky fixes. Changes to the authorization model or to policies touching live data were planned step by step before they were made.

CI gates. Closed findings are checked on every build, so the same mistake cannot quietly come back.

30 P1 and P2 findings were closed in one four-day stretch. The work covered Row Level Security policy design, edge function authorization, input bounds, secrets handling, webhook verification, AI guardrails, content security policy and account enumeration.

A 20-class vulnerability catalog with a detection technique and severity rating for each class, and a harness that runs the same checks against any project. I now run it on new builds from day one.

Vite, React, TypeScript and Tailwind, Supabase (Postgres, Auth, Row Level Security, Edge Functions), the Claude API, and Playwright for end-to-end tests.