Security & Vulnerability Reporting

Use a strong, unique password and protect the email account you use for recovery. Sign out of shared devices and never share credentials or sign-in links. Staff access must be granted through the authorized role process; a colleague’s account should not be used as a substitute.

Unpublished manuscripts, private review material, and participant records belong in authorized workflows. Use the platform’s permitted file-access paths rather than public sharing links. Access depends on your relationship to a submission, the venue, and assigned responsibilities. Contact support if you encounter information you should not be able to see.

Email the contact below with the subject “PaperNest security report”. Include the affected URL or feature, a concise description, minimal reproduction steps, expected versus observed behavior, and the potential impact. Redact credentials and personal or manuscript content from screenshots. If sensitive evidence is needed, first ask support for a suitable transfer method.

Use your own account and data, or obtain explicit permission for testing. Stop once you have enough evidence to describe the issue. Do not access other researchers’ files, alter records, interrupt availability, run bulk attacks, or disclose private information. Coordinate disclosure with the team so affected users can be protected. This page does not authorize intrusive testing or establish a bug-bounty reward.

Institutions can request deployment-specific information about access control, hosting, providers, recovery, and incident handling. No ISO, SOC, penetration-test, data-residency, or uptime certification is asserted by this page. Any formal assurance or service commitment must be supplied and agreed for the actual deployment.

For security concerns and responsible vulnerability reports, email media.brainfoundation@gmail.com.