Hi guys



First to be honest i'm not  sure if this a real security concern , but i decided to report it anyway.


When we request a resource that starts with `@` character over unencrypted http , your server at app.goodhire.com , redirects to a domain matching the source .

for example

```http
Get @evil.net  HTTP/1.1
Host: app.goodhire.com
```

**Markdown may change the format because of special syntax, check the screenshot**

Response will be :

```http
HTTP/1.0 301 Moved Permanently
Location: https://app.goodhire.com@evil.net
```

The `https://app.goodhire.com@evil.net` is not your domain , so this might not be widely exploitable , but i beleive this is not an ideal behaviour and requires a fix as it may have another consequences like impacting your cache.


Regards