Reactive Resume v6: a self-hosted resume builder with public default credentials you must change

The project moved to its own GitHub organization

The code now lives at reactive-resume/reactive-resume on GitHub, and GitHub Container Registry images publish to ghcr.io/reactive-resume/reactive-resume. Docker Hub keeps the old name, amruthpillai/reactive-resume. If you pin images or watch releases through the amruthpillai repository, update those references so you do not end up following a path that no longer receives changes.

The project is not standing still. The last push landed on 2026-11-02, v6.0.8 and v6.0.9 were both tagged on 2026-10-29, and package.json already reads version 6.0.10. A separate forme-native v0.0.0 tag appeared on 2026-10-30, tied to the Forme renderer described below. Two patch releases on one day means a self-hosted instance falls behind fast, so plan how you will pull new images rather than deploying once and forgetting the container. The package.json repository field also points at the new organization URL, so source builds and image tags agree on where the project lives.

The Compose stack ships with public credentials

compose.yml defines a project named reactive_resume with postgres:latest, redis:latest and chrislusf/seaweedfs:latest as backing services. Postgres is created with POSTGRES_DB, POSTGRES_USER and POSTGRES_PASSWORD all set to postgres. SeaweedFS runs with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY both set to seaweedfs and starts with this command:

server -s3 -filer -dir=/data -ip=0.0.0.0

The file's own comments say these credentials are public, which is why none of the backing services publish ports to the host by default. The comments warn that Docker's published ports bypass host firewalls, that the SeaweedFS bucket holds private uploads, and that Redis can contain agent stream data including user chat content. The consequence for you: uncommenting a ports block for debugging, without first replacing the sample passwords, puts private uploads and AI chat content behind credentials anyone can read in the repository. The commented examples bind to 127.0.0.1, for instance 127.0.0.1:5432:5432 for Postgres, and that loopback binding is the form to keep if you need host access.

Every service also uses a latest tag. Pulling updated images and recreating containers can bring in a new major version of Postgres or Redis; a simple restart does not pull a new image. Pin image versions or digests for predictable upgrades.

APP_URL and TRUSTED_PROXIES decide what breaks behind a proxy

.env.example starts with the application block that most deployment problems trace back to:

PORT="3000"
SERVER_PORT="3001"
TRUSTED_PROXIES=""
APP_URL="http://localhost:3000"

PORT is the public port for the production server and the Vite dev server, while SERVER_PORT is the Hono server port that Vite proxies API requests to during local development. APP_URL feeds auth callbacks, OAuth issuer URLs, OpenGraph metadata and absolute upload URLs, so leaving it at localhost on a real domain breaks sign-in redirects and shared links. TRUSTED_PROXIES is a comma-separated list of proxy IPs or CIDRs; only those socket peers may supply X-Forwarded-For, and the comment says never to trust a public client network.

Optional variables add behavior. ROOT_RESUME_ID serves one already-public resume at / and needs a restart after changes. APP_ALIAS_URL adds a second domain for public pages while sign-in and the editor stay on APP_URL. Custom domains need both CUSTOM_DOMAIN_TARGET and CUSTOM_DOMAIN_PROVIDER_SECRET, which Traefik's HTTP provider uses against /api/internal/traefik. On Vercel, APP_URL can be omitted because production uses VERCEL_PROJECT_PRODUCTION_URL.

Forme renders the PDF in a background worker

The v6 editor edits content inline on the page and lets you click to select elements. Live PDF preview and browser downloads come from Forme, rendered in a background worker, so the preview updates without blocking the editor. Drafts autosave, unsaved resume drafts can be recovered locally, and the editor keeps up to 200 undo steps.

There are 18 templates, including the newer Porygon and Smeargle, previewed with your own content. Filters split them into one-column, two-column and ATS-safe groups. You can pick font presets or custom fonts, colors, spacing, A4 or Letter paper, and a left or right sidebar. When content overflows a page, the fit controls adjust density, margins and text size. For anything the controls do not cover, Custom Styles accept Semantic CSS, with an element picker on the page to target what you want to change.

The ATS-safe filter matters because only part of the catalogue carries that label. Choosing a two-column design for looks and then sending it through hiring software is a decision you make yourself; the built-in view of the text hiring software reads is the way to check what survives.

Word imports need a connected AI provider

Imports accept Reactive Resume JSON, JSON Resume, LinkedIn data exports, PDF and Word files. JSON, LinkedIn and readable PDF imports work without AI. Word imports require a connected provider. If you refuse to connect any AI service, a resume that exists only as a .docx has to be retyped or converted to a readable PDF first.

The assistant sits beside a resume or letter, and conversations are tied to that document. Proposed edits show what changes and why, and you accept or reject each suggestion. It can improve selected text, review writing, and draft letters from a resume plus a job posting. Supported providers include OpenAI, Anthropic, Google Gemini, OpenRouter and Ollama, along with other compatible endpoints. Self-hosters can configure shared AI and web-access providers for every account on the instance.

The app itself has no paid tier, but hosting and provider usage may carry their own costs. On a shared instance with a shared provider key, every user's assistant calls bill to whoever owns that key, so decide who pays before you turn shared providers on.

Checks, cover letters and job tracking in one library

Resume checks pin readability findings to the relevant lines, match keywords from a job posting, and show the text hiring software reads. There are checks on the exported PDF, plus an optional AI writing review. A public ATS checker at rxresu.me/ats-checker reads PDFs in your browser without an account.

Resumes and cover letters share one searchable library with tags, sorting, and grid or list views. Cover letters have their own editor, exports and version history, and can be linked to a resume so sender details and design stay in sync. Automatic and named versions can be previewed and restored, and deleted items sit in a trash with a 30-day recovery window. Anything left past that window is gone.

The job tracker has List, Board, Insights and Calendar views for applications from Saved to Offer. Jobs can be saved from a URL or a pasted posting, with optional keyword search through Firecrawl, Tavily or Exa. You can tailor a resume and draft a letter for a saved job, track contacts and follow-ups, export calendar events, and move applications in or out as CSV.

A REST API and MCP server expose the same documents

Beyond the browser, a REST API and an MCP server cover document management, imports, exports, checks and application workflows. The repository also carries a .claude-plugin directory and a plugins tree, and the Dockerfile copies plugins/reactive-resume/skills into the build because the server bundles the published agent skills. For people who already drive tools through an AI agent, this is the route to updating a resume or logging an application without opening the editor.

The flip side is exposure. An API that can export and share documents is a credential worth protecting, and the account features to lean on are passkeys, two-factor authentication and linked sign-in providers. Public share links can carry optional password protection and record view and download statistics. Account data can be exported and the account deleted, and the project states there is no tracking and no ads. The interface ships in multiple languages with light, dark and system themes and reduced-motion support.

Source builds pin Node 24 and a Turbo monorepo

package.json requires Node 24.x and declares [email protected] as the package manager, with workspaces under apps, packages and tooling. The Dockerfile starts from ghcr.io/pnpm/pnpm with PNPM_VERSION 12.14.0 and TURBO_VERSION 2.11.9, and a comment notes that pnpm self-manages to the packageManager version. A pruner stage runs turbo prune for the web and server apps, then the builder installs with a frozen lockfile and runs the build. Telemetry is off through TURBO_TELEMETRY_DISABLED=1. Optional TURBO_TEAM and a TURBO_TOKEN secret mount enable Turbo's remote cache; the token is a secret mount because build args are recorded in published provenance.

Self-hosting targets are Docker, Vercel, Cloudflare Workers, or a 1-click deploy on Hostinger. The Cloudflare path is a script in package.json:

"deploy:cloudflare": "pnpm build:cloudflare && wrangler deploy",

A check:cloudflare script runs the same build followed by wrangler deploy --dry-run. Database work goes through dotenvx reading .env.local, for example db:migrate. A machine on an older Node release will not satisfy the engines field, so upgrade before building from source.

Editorial conclusion

Reactive Resume fits job seekers who want a free builder with no tracking or ads, and self-hosters who are comfortable running Postgres, Redis and an S3 store behind Docker. It does not fit anyone who wants Word imports without connecting an AI provider, or who plans to expose the Compose stack with its public sample credentials. Before deploying, replace the postgres and seaweedfs credentials, set APP_URL and TRUSTED_PROXIES correctly, and point your image pulls at the new reactive-resume organization.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes