Skip to content
Ho Dinh Tri
Work

Cloud & Backend

SmartATS: AI-Assisted Applicant Tracking

A full-stack ATS with LLM CV parsing, semantic ranking behind hard filters, and access control designed against the OWASP API Top 10.

Key results

REST APIs
54
across 10 modules
multilingual embeddings
768-d
pgvector HNSW, ranked only after boolean hard filters
signed URL lifetime
15 min
short-lived SAS links for CV files on Azure Blob
panel approval to advance
80%
consensus rule computed server-side

Problem#

Recruiters need to filter hundreds of CVs without a ranking model quietly overriding hard requirements — and an ATS holds exactly the kind of personal data attackers enumerate.

What it does#

SmartATS architecture: Next.js front end, FastAPI with 54 REST APIs and RBAC/ABAC, PostgreSQL with pgvector, Azure Blob Storage, Gemini, GitHub and Google Calendar, with LLM telemetry

  1. Apply — a candidate uploads a PDF CV through a public job link; an LLM extracts structured fields.
  2. Rank — required skills run first as a hard filter; only survivors are ranked by multilingual-e5-base embeddings inside Postgres with pgvector.
  3. Enrich — public GitHub activity is summarised into a skills matrix.
  4. Review — a candidate advances only when 80% of the review panel approves.

Key technical decisions#

  • Hard filters before semantic search. A missing required skill eliminates a candidate regardless of similarity score.
  • Rules computed on the server. Thresholds and approval counts are sent to the browser, never re-derived there.
  • Access control mapped to the OWASP API Security Top 10 (2023):
    • API1 — Broken Object Level Authorization: ABAC checks access to the specific candidate record, which blocks ID enumeration.
    • API3 — Broken Object Property Level Authorization: per-field PII masking.
    • API5 — Broken Function Level Authorization: role-based checks on admin functions.
  • Safe uploads: PDF magic-byte verification and 15-minute SAS URLs on Azure Blob Storage, plus audit logging.

Observability#

LLM calls are tracked for p95/p99 latency, token usage and cost.

Limitations — what this does not prove#

SmartATS is a course project. It has not handled production traffic, and ranking quality has not been measured against real hiring outcomes.

All work