<?xml version="1.0" encoding="UTF-8"?>
<!--
  CandidateRank public sitemap.

  Canonical host is the APEX: https://candidaterank.in  (www 301s to it).
  Every loc below is apex + https + no trailing slash, except the root "/".

  THIS FILE IS AN ACCESS CONTROL BOUNDARY, NOT A BUILD ARTIFACT.

    1. Hand written allowlist. Adding a line here is a decision to publish a
       page to the open web. Nothing gets in by default.
    2. NEVER generate this from the router. src/App.jsx holds token routes,
       auth gated routes and redirects side by side with the marketing pages;
       any generator that walks it will publish the private surface the first
       time somebody adds a route, and will do it silently.
    3. NEVER list a route that takes a path parameter (a segment written with
       a leading colon in App.jsx). Those are the unguessable link surfaces:
       public forms, the collection and resume portals, the student profile
       portal, attendance scan, public leaderboards, the account claim link
       and the GitHub ownership check. Their entire protection is that the URL
       is unguessable and unlinked. A sitemap is the first file every crawler
       and every scraper fetches, so one line here ends that permanently and
       retroactively.
    4. Marketing pages only. /employer and /student are in the site nav but
       are auth walls that bounce to a login, so they are deliberately absent.

  lastmod is the real last commit date of that page's component, read out of
  git history. Bump one only when the page's rendered content actually changes,
  not when this file is touched.

  DO NOT SUBMIT THIS TO SEARCH CONSOLE BEFORE PRE RENDERING IS LIVE.
  See docs/seo-search-console-runbook.md for why and for the order of steps.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

  <!-- HomeLanding.jsx : the logged out front door -->
  <url>
    <loc>https://candidaterank.in/</loc>
    <lastmod>2026-08-17</lastmod>
  </url>

  <!-- AboutPage.jsx -->
  <url>
    <loc>https://candidaterank.in/about</loc>
    <lastmod>2026-08-09</lastmod>
  </url>

  <!-- HowToUsePage.jsx -->
  <url>
    <loc>https://candidaterank.in/how-to-use</loc>
    <lastmod>2026-08-17</lastmod>
  </url>

  <!-- MethodologyPage.jsx -->
  <url>
    <loc>https://candidaterank.in/methodology</loc>
    <lastmod>2026-08-17</lastmod>
  </url>

  <!-- HivemindNetworkPage.jsx -->
  <url>
    <loc>https://candidaterank.in/network</loc>
    <lastmod>2026-08-17</lastmod>
  </url>

  <!-- ContactPage.jsx -->
  <url>
    <loc>https://candidaterank.in/contact</loc>
    <lastmod>2026-08-03</lastmod>
  </url>

  <!-- PrivacyPage.jsx -->
  <url>
    <loc>https://candidaterank.in/privacy</loc>
    <lastmod>2026-07-07</lastmod>
  </url>

  <!-- TermsPage.jsx -->
  <url>
    <loc>https://candidaterank.in/terms</loc>
    <lastmod>2026-07-07</lastmod>
  </url>

  <!--
    OPEN DECISION, OWNER ONLY: /pricing.

    The page is live and reachable, but it is deliberately unlisted in the nav
    and the footer until founding cohort pricing has been validated in real
    conversations (SiteChrome.jsx, commit a6aa89c). Unlisted is not the same as
    private, so this is a judgement call, not a security one.

    If the owner decides to index it, delete this comment wrapper and keep the
    block below. lastmod 2026-08-15 is PricingPage.jsx's real last commit date.

  <url>
    <loc>https://candidaterank.in/pricing</loc>
    <lastmod>2026-08-15</lastmod>
  </url>

  -->

</urlset>
