How information is protected
- Role-based permissions separate administrator, supervisor, employer and candidate access.
- Candidate CVs are private by default and require an explicit visibility choice.
- Authentication and sensitive actions use bounded, route-specific rate limits.
- HTTPS, browser security headers and restrictions on framing and unnecessary device access protect website sessions.
- Administrative decisions, security-sensitive activity and maintenance checks are recorded for review.
- Private backups are read back and structurally validated through the backup cycle.
No online service can guarantee absolute security. PhDnomics reviews safeguards as the platform and identified risks change.
Report a suspected vulnerability
Email support@phdnomics.com with the affected URL, a concise description, reproducible steps, potential impact and a safe way to contact you. Do not include passwords, CVs, access tokens or unrelated personal information in the report.
Please keep the report confidential while it is investigated. Stop testing if you encounter private information, loss of service or any indication that another person or organisation could be affected.
Research and testing boundaries
This page does not grant permission to scan, exploit, disrupt or access data beyond your own account. Do not use denial-of-service testing, social engineering, credential attacks, malware, automated account creation, bulk extraction or testing that changes or destroys information. Written authorisation is required before conducting security research against PhDnomics.
PhDnomics does not currently offer a public bug-bounty programme or promise payment for unsolicited testing.
Protect your account
- Use an email account that you control and protect it with a strong, unique password and multi-factor authentication where available.
- Do not share sign-in links, reset links or account access.
- Sign out on shared devices and report unexpected account activity promptly.
- Verify opportunity details and external application sites before sending documents or personal information.
Automated access
Ordinary search-engine indexing of public pages is permitted subject to robots.txt. Scraping, bulk collection, database replication, AI-training use and automated access for other purposes require prior written permission under the Terms of Use.