While the project's implementation is outdated, it still is easier for brave souls to maintain and extend it than start your own from scratch. The project is on GitHub. The link is on the website.
Consider who uses this -- and I don't mean that recruiters have zero technical knowledge (rumor has it that some do) but rather that an applicant will see very little if anything of this. If you test and secure those public fields properly and make sure the rest is behind basic auth with individual user credentials, you probably covered your threat model. XSS/CSRF vulns potentially cause you to lose track of who put that exploit in (one user could have put an exploit in that makes another do something), so you know it was an insider, just not who. Once you have your update management figured out (at least for public systems) and people no longer click attachments to invite ransomware (I have yet to see a single client with these two boxes ticked), rewriting your internal limited-to-recruiters applicant system might be the next thing to tackle.