Playbooks · Everyday tasks · last verified 2026-10-24

Keep your job-hunt repo private

For a job seeker × setting up an AI job-search framework × with Claude Code and git, without publishing a profile to the internet.

Before you start

You need a GitHub account and git installed. This playbook covers the ai-job-search framework, whose README states the problem plainly: a fork of a public repository is always public — GitHub does not allow private forks of public repositories — and its /setup step writes your name, contact details, work history, and salary expectations into tracked files. Push a fork and all of that is public. The fix is a private repository of your own with the original repo as the upstream remote, so you still receive updates.

Two facts from the same setup guide soften the problem without removing it. The genuinely sensitive files — the application tracker, salary data, the documents/ folder, and application archives — are gitignored and never enter git either way. And committing locally without pushing at all is also fine. The leak is specifically the profile files /setup writes into tracked files, which is why the remote matters.

Time and cost: NOT_MEASURED. No outcome is promised: a private copy is a safety step, not a better chance of being hired.

What "done" looks like

At the end of one sitting you have a local copy of the framework whose git remotes point at your private repository for your work and at the original project for updates, and you have confirmed with git status that no personal file is staged for a public remote. Only then do you run /setup and fill in your profile.

Steps

Create an empty private repository. On GitHub, create a new repository, set it to private, and do not add a README, license, or gitignore — an empty repository avoids a first-push conflict. Note its URL; it becomes your origin below.
Clone the framework locally, without forking. Run:
```
git clone https://github.com/ai-job-search-dev/ai-job-search ai-job-search
cd ai-job-search
```
Do not use the fork button for a copy meant for your own job search. Fork only if you intend to contribute changes back to the project — that is the README's own distinction.
Swap the remotes. The clone's origin currently points at the public project. Move it to the upstream slot and put your private repository in its place:
```
git remote rename origin upstream
git remote add origin https://github.com/YOU/your-private-repo.git
git push -u origin HEAD
```
Replace the URL with your private repository's URL. From here, your commits go to your private repository, and the original project stays reachable as upstream for updates.
Check what git would send, before you trust it. Run git status and read the list. Tracked files are the ones that travel on push; the tracker, salary data, documents/, and application archives should not appear, because the project gitignores them. If a file holding your personal details appears as a change to a tracked file, that is expected after /setup — it is safe only because the remote is your private repository. If the remote were public, that same push would publish it.
Now run the profile setup. Follow the framework's own setup from here: install the portal tools, open Claude Code in the project directory, and run /setup. The details are on our ai-job-search install page. The order matters: private remote first, personal details second.
Take updates from upstream, not from a re-clone. When you want a newer release, fetch the project's tags and preview what changed before merging, using the project's own tool:
```
git fetch upstream --tags
python3 tools/check_upstream_updates.py
git merge v1.0.0
```
Substitute the release tag you actually want for v1.0.0. The preview tool compares version markers in the framework files and lists exactly which of your personalized files a release touches, so you merge with your eyes open. The project's guide recommends tagged releases over raw main-branch pulls, since releases are vetted checkpoints.

Check the agent's work

Run git remote -v: origin points at your private repository, upstream points at the public project. If origin still points at the public project, stop before running /setup.
Run git status before every push: every file it lists as a change is a file the push will send. Personal details in tracked files are fine only while the remote is private.
Never click fork on a repository you plan to fill with your own details. A fork cannot be made private afterward.
The same rule applies to any other job-search checkout, including career-ops: its data, reports, and output folders are gitignored by the project, but anything else in the checkout travels on push, so check git status before pushing any checkout anywhere.

What can go wrong

You forked first and already pushed a profile. Making the fork private is not an option — GitHub does not allow it. Delete the fork, and treat anything it contained as published: change anything sensitive it held that can be changed, and start over with the private-repository recipe above.
An uncommitted working tree blocks an update. The project's guide names this as the most common reason a pull refuses to merge. Commit your personalization to your private repository first, then pull from upstream.
A merge conflict in a personalized file. The project's guide calls this a feature, not a failure: it means upstream changed a methodology section you customized. Resolve it by keeping your data and adopting the methodology change around it, not by accepting one side wholesale.

Limits

A private repository is private to your account, not encrypted: anyone with access to your GitHub account can read it. This playbook does not cover account security.
Nothing here stops the AI provider you use from receiving your CV — the framework sends your profile to the provider you chose as part of its work. The private repository only controls what is published on GitHub.
The framework's own warning covers its own profile files. Other tools you add to the same checkout may write personal data to other files; the git status check before each push is what catches those.

Verification

Checked 2026-10-24. This page was not run end to end; its claims rest on the author's own documentation fetched this run. Sources: ai-job-search README (Quick start: the public-fork warning and private-repository recommendation; the /setup tracked-files warning) and ai-job-search SETUP.md section 8 (private-repository recipe, gitignored files, update preview tool, tagged-release recommendation, fork-deletion framing); career-ops README (project structure: data, reports, and output folders gitignored). Omitted: no claim is made that a private repository encrypts your data or that any provider keeps your CV private — the page says the opposite in Limits. Limits of this verification: the git commands are standard git behavior plus the project's own recipe; they were not executed against a live GitHub account in this pass.

Back to: Everyday playbooks hub · Skills index