Report a security problem
If you have found a weakness in one of our sites, we want to hear about it before anyone else does. This page says where to write, what to send, what we promise in return, and what is out of bounds.
Where to write
E-mail mou@smartscholars.in with "Security" at the start of the subject line. Please do not post it in a public place, a review or a chat window first.
Send what we need to see it ourselves: the address of the page, what you did, step by step, what you saw, and why it matters. A screenshot or a short recording helps. If you found it with a tool, name the tool.
What we promise
- A reply from a person within two working days, saying we have it and who is looking at it.
- We tell you when it is fixed, and what we found.
- If our clients' data was reached, we tell them within 72 hours of learning of it, as our incident plan says.
- With your agreement, we thank you by name on this page once the fix is in place.
- We will not take legal action against you, or ask anyone else to, for research done in good faith within the rules below.
The rules for good-faith research
- Look at no more data than you need to show the problem. Stop as soon as you see someone else's data, and do not keep, copy or share it.
- Change nothing and delete nothing — not a record, not a file, not a setting.
- Use only your own account. Never sign in as anyone else or guess a password.
- Do not slow the sites down: no flooding, no denial-of-service tests, no automated scanning at high speed.
- No social engineering of our people or our clients, no phishing, and no physical access.
- Give us a fair chance to fix it — 90 days, or sooner once the fix is out — before you tell anyone else.
Which sites this covers
- smartscholars.in — this site
- doidoctor.smartscholars.in — DOI Doctor
- getindexed.smartscholars.in — GetIndexed
- journalevaluate.smartscholars.in — Journal Audit
- registry.smartscholars.in — the Smart Scholars Registry
- journals.smartscholars.in · members.smartscholars.in · partners.smartscholars.in · institutions.smartscholars.in · scholar.smartscholars.in · grants.smartscholars.in · hosting.smartscholars.in — the platform's doors
Not covered: our clients' own journal sites (write to the journal), and the services we use but do not run — Crossref, doi.org, Google, GitHub, our web host. Report those to them; we are glad to help you reach the right person.
Thank you
No report has been made under this policy yet. The people who help us will be named here, with their agreement.
This policy is also published in the standard machine-readable form at /.well-known/security.txt. There is no reward programme; we say thank you in public instead. How we keep your data safe →
