Skip to main content

Worldwide, the research workforce represents the equivalent of approximately 12 million full-time researchers. Join ScholarFolk and become part of a global scientific community.

Source
ScholarFolk
Sign in

Security at ScholarFolk

In force since November 7, 2026 · Version 2026-11-07.2

Security at ScholarFolk

Updated November 7, 2026. This page describes how ScholarFolk protects accounts and content, and how to report a vulnerability.

Signing in

  • There are no passwords to steal or reuse. You sign in with a one-time e-mail link, with ORCID or with Google. E-mail links work once, expire after 15 minutes and are only spent when you press the confirmation button, so automatic link scanners cannot use them.
  • Two-factor authentication with any authenticator app (TOTP) can be switched on in Settings > Security. Recovery codes let you in if you lose the app. Changing sign-in methods, two-factor settings or deleting the account requires a recent sign-in.
  • Settings > Security lists every device signed in to your account with browser, platform, address and last activity. You can sign out any device, or all other devices at once, and review your recent account activity.

Protecting data

  • Access tokens for ORCID and two-factor secrets are encrypted at rest with AES-256-GCM. Recovery codes are stored only as hashes.
  • Connections use TLS. Pages carry a strict Content Security Policy with per-request nonces, and the usual protections against clickjacking, content sniffing and cross-site requests.
  • Uploads are checked by their actual bytes, images are re-encoded with location metadata removed, and videos are transcoded before they are shown. Private media is served only to people entitled to see it; there are no permanent public links to stored files.
  • Requests are rate limited per client, including sign-in attempts, uploads, messages and reports. Suspicious bursts are refused with a retry delay rather than served.
  • The server never fetches arbitrary addresses on your behalf: external lookups are limited to ORCID, Crossref, DataCite and the identity providers.

Privacy by design

  • Your e-mail address is private unless you choose to show it. Audience controls for posts, videos and stories are enforced on the server, including on the files themselves.
  • Blocking removes the other person's access to your content and contact; muting hides their content from you silently.
  • The account activity log is kept for 365 days and then deleted automatically.

Reporting a vulnerability

If you find a security problem, please tell us before making it public. Write to the contact address published on this site with a description and steps to reproduce. We acknowledge reports within a few days, keep you informed and credit you if you wish. Please do not access other people's data, degrade the service or run automated scanners against production systems.