Jobrow

Public register of still-open US tech roles, read from employer ATS JSON - not from another job site.

Tagline: Still open.

https://jobrow.vercel.app

Production is Neon Postgres on Vercel Hobby. The board currently holds 5,000+ open US tech roles across 50 companies. Apply always leaves Jobrow for the employer ATS. Public listings - not an employer, recruiter, or agency.

GET /api/health reports { db, openJobs, pendingBoards, staleBoards, lastOkAt }.

Unauthenticated read API for the same US-tech slice Jobs shows (status=open, us_eligible, tech_eligible). Native apps and other clients can call these without going through server functions:

• GET /api/jobs - JobQuery as querystring (q, fn, seniority, workplace, location, salaryMin, posted, ats, company, sort, page). Page size 40.
• GET /api/jobs/:id - one role, with sanitized description_html plus description_text
• GET /api/companies - boards
• GET /api/companies/:slug - board plus open roles
• GET /api/home - register KPIs (open count, boards, first-seen 24h, last crawl, functions, boards) plus a latest page
• GET /api/closed - roles closed after a successful crawl

/api/health, /api/desk, cron, and admin are unchanged. Product auth stays off. Apply URLs are employer ATS https links. Discovery helpers: /sitemap.xml, /llms.txt.

An Expo (Android + iOS) client lives in mobile/. It is a separate package so the Vercel web build does not compile it. See mobile/README.md to run it in the iOS simulator or Android emulator.

Lattice - free board for blockchain, crypto, and Web3 jobs from live employer ATS boards (Coinbase, Binance, Ripple, and more). Jobrow stays US tech; Lattice covers Web3 careers. Source: devtechedge/lattice.

Jobs	Search

Role	Companies

About	Pricing

Share card: docs/screenshots/social-preview.png

• Jobs (/) - Latest (8 roles, one company per row), filters, KPIs, Companies strip (8)
• Closed (/closed) - roles removed after a successful crawl (filled or pulled)
• Company marks next to every listing (site icon, initials if the icon fails)
• Search (/jobs) - full paginated table of the US tech slice
• Companies (/companies) - 50 boards, US-tech count vs listed count, last successful fetch
• Saved - browser watchlist count in the header (nav: Jobs · Search · Companies · About · Saved · Closed)
• Role (/jobs/:id) - summary, pay, workplace, posting HTML, Apply (leaves the site)
• Contact (/contact) - corrections and legal notes (not applications)
• Add a board (/employers) - public Greenhouse / Ashby / Lever / Workable token
• Pricing (/pricing) - Bound pass waitlist ($11 / 28 days). No live checkout
• Promote (/placements) - Ruled pin $120 / masthead line $55. Waitlist only
• Watchlist - local to the browser (localStorage key jobrow:watchlist, max 200). No account. No resume upload
• JSON API (/api/jobs, /api/companies, /api/home) - public register contract for native apps
• iOS / Android - Expo app in mobile/. Apply opens the employer ATS. Saved jobs use local AsyncStorage.
• Admin (/admin) - password-gated crawl and board edits

A role drops when a successful crawl no longer sees it. A failed fetch does not close that board.

Seeded from data/companies.csv and src/lib/seed-companies.ts. Tokens were confirmed against live public board JSON.

US-eligible tech titles stay on Jobs. Sales, finance, and non-US postings on the same board are ignored. The companies table shows both US tech and listed (raw JSON rows on the last good fetch).

1. Confirm the public board JSON exists:
   • Greenhouse: https://boards-api.greenhouse.io/v1/boards/{token}/jobs
   • Ashby: https://api.ashbyhq.com/posting-api/job-board/{token}?includeCompensation=true
   • Lever: https://api.lever.co/v0/postings/{token}?mode=json
2. /admin → unlock with ADMIN_PASSWORD → name / slug / ATS / board token / careers URL → crawl that row.
3. Or append a line to data/companies.csv and a matching object in SEED_COMPANIES.

Do not scrape career marketing HTML when the board JSON exists. Do not scrape other job aggregators.

npm install
npm run dev

Without DATABASE_URL the app uses embedded PGLite and seeds the 50 boards on first load.

npm test
npm run typecheck

Env template: .env.example. Never commit secrets.

Production already has Neon attached. Local demos can omit DATABASE_URL.

See SECURITY.md. Report vulnerabilities with GitHub private advisory, not a public issue.

Hardening in this tree: parameterized SQL, escaped job HTML, script-safe JSON-LD, fail-closed admin/cron secrets in production, IP-limited admin unlock, public API rate limits, ATS host allowlist, no ?secret= on cron, desk size cap, HTTPS-only Apply links, HSTS + CSP headers. Details: SECURITY.md.

MIT. See LICENSE.