To resolve this warning, I added a Cache-Control header with the value max-age=31536000 to the HTTP responses of my domain (31536000 is the number of seconds in a year).

I host nelson.cloud on Amazon CloudFront. I added this header to the CloudFront Distribution that the nelson.cloud domain points to. This can be done by adding a “Response headers policy” in the Behavior of the Distribution. I wrote a post demonstrating how to do this in detail: How to Add a Custom Response Header to an Amazon CloudFront Distribution.

After the header was configured, I checked PageSpeed Insights again and the warning had gone away for the assets under my domain nelson.cloud:

(The remaining asset is not under my control so I can’t fix that one.)

Note:

You may be able to use a different value smaller than 31536000 for your header. I chose a year in seconds to be on the safe side for PageSpeed Insights.

References

• https://developer.chrome.com/docs/lighthouse/performance/uses-long-cache-ttl/
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control
• https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html

Disclaimer:

This is purely for educational purposes. I don’t plan on collecting information and using it for malicious purposes.

I started by searching domains that host static sites like github.io and pages.dev.

I found a lot of resumes with this Google search. Try this search yourself.

resume.pdf filetype:pdf site:github.io

Searching for resume instead of resume.pdf also works, but the results are polluted by “Resume Guide” PDFs, etc.

Searching for the standard github.com domain also yields lots of results. Try this search yourself.

resume.pdf filetype:pdf site:github.com

After GitHub I decided to try the pages.dev domain used by Cloudflare Pages. Here is a simple search query that gives good results. Try this search yourself.

resume filetype:pdf site:pages.dev

The Netlify domain netlify.app is used for static pages and also hosts a lot of resumes that users upload. Try this search yourself.

resume filetype:pdf site:netlify.app

There are top level domains (TLDs) commonly used for personal sites, such as .me and .dev. These domains are also great for finding resumes. Here’s a Google search for the .me TLD. Try it yourself.

resume filetype:pdf site:*.me

And here is a Google search for the .dev TLD which is commonly used by developers. Try this out yourself.

resume filetype:pdf site:*.dev

I didn’t try this with other TLDs but I know that other TLDs like .id, .blog, and .codes are usually used for personal sites. Feel free to search by these TLDs and see what you can find!

We can take this further. What if we want to find people based on something more specific than a domain or TLD? I’ll keep using the .dev TLD for simplicity but there are many possibilities.

Maybe we want to find someone in a specific city? Try it yourself.

boston resume filetype:pdf site:*.dev

Or someone that went to a particular college? Try it yourself.

University of California Los Angeles resume filetype:pdf site:*.dev

Someone that works or worked at a certain company? Try it yourself.

"Apple, Inc" resume filetype:pdf site:*.dev

Maybe we want the name, number, and address of someone who has worked at a defense company and may know sensitive information important to U.S. national security? Note that I didn’t filter based on domain or TLD here. Try it yourself.

"resume.pdf" "Raytheon" filetype:pdf

(I’m just joking. Please don’t come after me, feds.)

I also considered writing a script to run these searches for me, gather all PDF links, download the PDFs, and then parse through them for names, numbers, emails, and addresses. But I stopped because I have no interest in collecting this information. I just wanted to see and show others how easy it is to find information on the open web. It’s definitely possible to write a script to do this though.

Conclusion

In conclusion, it’s really easy to find private information on resumes posted online. Please reconsider if you are thinking of making your resume available online.

Further Reading

I am not the first to have this idea. Here’s a similar post that you should also check out:

• https://www.trickster.dev/post/simple-ways-to-find-exposed-sensitive-information/