Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/org/sopt/kareer/domain/member/controller/MemberController.java`:
- Around line 167-177: Remove the checked IOException from the controller method
signatures and ensure OCR failures are converted to a domain/runtime exception
and mapped to a standard error response: stop declaring "throws IOException" on
getVisaInfo/getPassportInfo and instead handle IO errors coming from
memberService.getVisaOcr(file) and memberService.getPassportOcr(file) by either
(a) catching IOException in the controller and rethrowing a custom unchecked
OcrProcessingException (or returning a standardized BaseResponse error), or (b)
converting IOException inside the service into a domain exception; add an
OcrProcessingException (or reuse a suitable domain exception) and
register/extend the global exception handler (e.g., GlobalExceptionHandler) to
translate that exception into the unified error response and proper HTTP status.
Ensure you reference memberService.getVisaOcr and memberService.getPassportOcr
when making the change.

In `@src/main/java/org/sopt/kareer/domain/member/service/MemberService.java`:
- Around line 184-195: The getVisaOcr and getPassportOcr methods currently
propagate IOException from DocumentProcessingService.extractText; instead catch
IOException inside these methods and convert it to a domain/runtime exception
(e.g., DocumentProcessingException or a checked-to-unchecked wrapper used
elsewhere like ResumeContextService) so the service layer does not expose
checked IO exceptions; update getVisaOcr and getPassportOcr to try-catch around
extractText, log or include the cause, and throw the chosen domain exception
while preserving the original exception as the cause.

In `@src/main/java/org/sopt/kareer/domain/member/util/PassportOcrParser.java`:
- Around line 27-37: The PassportOcrParser currently logs sensitive PII (rawText
and MRZ contents) via log.info using variables rawText and mrz (from
DocumentTextUtils.normalize and extractMrz); remove or replace these logs so PII
is not written to INFO: either delete the log.info calls referencing rawText and
mrz or log non-sensitive metadata only (e.g., masked values or presence/length
flags) before returning PassportInfo, ensuring no full name, DOB, document ID,
or MRZ lines are emitted.

In `@src/main/java/org/sopt/kareer/domain/member/util/VisaOcrParser.java`:
- Around line 40-42: In VisaOcrParser.parse, stop logging the full normalized
OCR string (DocumentTextUtils.normalize result) to avoid leaking PII; instead
log only non-identifying metadata such as the normalized text length and a
parse-success indicator (or a stable hash/fingerprint if you need correlation)
using the existing logger (log.info) and keep any detailed errors at debug level
without including raw text; update references in parse to remove the rawText log
and replace it with e.g. length/hashed summary and success/failure information.

In
`@src/main/java/org/sopt/kareer/global/document/service/DocumentProcessingService.java`:
- Around line 46-47: The image/PDF content-type checks in
DocumentProcessingService are too strict and fail when Content-Type is missing
or set to application/octet-stream; update the logic so that when handling
uploads (methods calling isImage(...) / extractPagesFromImage(...) and the PDF
branch using isPdf(...) / extractPagesFromPdf(...)) you fall back to the
uploaded filename extension (use the original filename from the MultipartFile or
equivalent) — e.g., enhance or add a helper like isImageByExtension(filename)
and isPdfByExtension(filename) and change the branches to use: if
(isImage(contentType) || isImageByExtension(filename)) return
extractPagesFromImage(file); and similarly for PDF (lines around
extractPagesFromPdf) so JPEG/JPG/PNG files with missing MIME types are correctly
recognized.

In `@src/main/java/org/sopt/kareer/global/document/util/DocumentDateUtils.java`:
- Around line 49-51: DocumentDateUtils의 2자리 연도 처리에서 고정 컷오프(>=50)를 사용해 미래 생년월일이
만들어지는 문제가 있습니다; 대신 parse/convert 로직(해당 메서드에서 year += (year >= 50 ? 1900 : 2000);
및 return LocalDate.of(...))을 변경해 먼저 2자리 연도를 1900/2000 기준으로 변환한 뒤(LocalDate 생성
시), 생성된 날짜가 오늘(today)보다 미래라면 year -= 100 하여 100년 뒤로 보정하는 동적 피벗 방식을 사용하도록 수정하세요.
Ensure the adjustment happens before returning the LocalDate and keep validation
of month/day as-is.
- Around line 29-31: The code in DocumentDateUtils force-uppercases the input
(the variable `value` via `.toUpperCase(Locale.ROOT)`), which breaks parsing of
English month names for the `DateTimeFormatter` patterns `d MMM yyyy`/`dd MMM
yyyy`; remove the `.toUpperCase(Locale.ROOT)` call from the `value`
normalization or alternatively make the formatters case-insensitive by using
`DateTimeFormatterBuilder.parseCaseInsensitive()` when building the
`DateTimeFormatter` instances used by the parsing methods (keep references to
the `value` variable and the formatter-building logic in DocumentDateUtils to
locate where to change).

---

Nitpick comments:
In
`@src/main/java/org/sopt/kareer/domain/member/controller/MemberController.java`:
- Around line 164-178: Add the same `@CustomExceptionDescription` metadata to the
two OCR endpoints so their Swagger error contracts match the rest of the
controller: annotate the getVisaInfo and getPassportInfo methods in
MemberController with the same `@CustomExceptionDescription` annotation (and
parameters/codes) used on other endpoints in this class so the error responses
are documented consistently for these POST /onboard/ocr/visa and POST
/onboard/ocr/passport handlers.

In `@src/main/java/org/sopt/kareer/domain/member/util/CountryResolver.java`:
- Line 13: The field ISO3_MAP in CountryResolver is an instance field but uses
constant-style naming; rename ISO3_MAP to iso3Map to follow Java camelCase
conventions and update all references/usages of the field (constructors,
methods, tests) accordingly; ensure access modifiers and behavior remain
unchanged and run tests/compilation to confirm no remaining references to
ISO3_MAP.
- Around line 31-32: The empty catch in CountryResolver silently swallows
exceptions making mapping failures hard to debug; add Lombok `@Slf4j` to the
CountryResolver class and replace the empty catch(Exception ignored) block with
a log call (e.g., log.debug or log.warn) that includes context and the exception
(for example: "Failed to resolve country for input {}" plus the exception) so
failures are recorded for diagnostics while preserving existing behavior.

In `@src/main/java/org/sopt/kareer/domain/member/util/PassportOcrParser.java`:
- Around line 79-81: In collectCandidates, avoid compiling the regex on every
call; extract Pattern.compile("[A-Z0-9<]{20,}") into a reusable static final
Pattern (e.g., MRZ_PATTERN) at class level in PassportOcrParser and replace the
local Pattern.compile(...) usage with MRZ_PATTERN.matcher(upper) so the same
compiled Pattern is reused across invocations.

In
`@src/main/java/org/sopt/kareer/global/document/exception/DocumentException.java`:
- Around line 10-12: The second constructor in DocumentException (public
DocumentException(DocumentErrorCode errorCode, String message)) has its
super(...) call indented with 2 spaces while the first constructor uses 4
spaces; update the indentation of the super(errorCode, message); line in that
constructor to match the 4-space indentation style used for the first
constructor so formatting is consistent across both constructors.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/org/sopt/kareer/global/external/clova/service/ClovaOcrService.java`:
- Around line 61-71: The ClovaOcrService builds a ClovaException including raw
provider response (errorBody) which then gets returned to clients; change the
code so the detailed provider body is only logged via log.error and not embedded
in the ClovaException message — create the ClovaException using safe metadata
(e.g., "CLOVA OCR error. status=<status>") and
ClovaErrorCode.EXTRACT_IMAGE_FAILED, while keeping the full errorBody and any
exception details in the log.debug/error call; apply the same change to the
second occurrence that constructs a ClovaException around lines handling
clientResponse/bodyToMono to ensure external messages are generalized.
- Around line 77-85: The current check in ClovaOcrService that returns "" for
response==null, images==null/empty, or fields==null masks provider errors;
change the logic so only fields.isEmpty() is treated as a valid empty OCR result
(return ""), while response==null, response.images()==null,
response.images().isEmpty(), or fields==null should throw an exception (e.g., an
ExternalServiceException or propagate a runtime exception) so
DocumentProcessingService sees provider failures instead of silently treating
them as empty pages; adjust the checks around response, images(), and fields()
accordingly in the method that reads the OCR response.

---

Nitpick comments:
In `@src/main/java/org/sopt/kareer/domain/member/service/MemberService.java`:
- Around line 184-197: In getVisaOcr in MemberService, wrap and propagate the
original exception details into the DocumentException so debugging info isn't
lost: when catching generic Exception (or specifically IOException rethrown from
DocumentProcessingService.extractText), call the DocumentException constructor
that accepts (ErrorCode, String messageDetail) and pass the original exception's
message (e.getMessage()) or a combined message with context (e.g. "OCR failed: "
+ e.getMessage()), and optionally include exception class name; keep the thrown
type DocumentException and do this inside the catch(Exception e) block
referenced in getVisaOcr.

In `@src/main/java/org/sopt/kareer/domain/member/util/PassportOcrParser.java`:
- Around line 150-170: The try-catch in extractCountry is unnecessary because
CountryResolver.resolveIso3 does not throw; remove the surrounding try-catch
block in the extractCountry method and keep the existing logic: check line1 ->
normalizeLineLength(line1) -> substringSafely(...,2,5) ->
countryResolver.resolveIso3(code) and if non-null return it; otherwise check
line2 using normalizeLineLength(line2) and substringSafely(...,10,13) and return
countryResolver.resolveIso3(code); preserve the final return null path and
existing helper calls (normalizeLineLength, substringSafely,
countryResolver.resolveIso3) but eliminate the exception handling wrapper.