Security

Report a vulnerability to hello@lacspace.com. You will get a human acknowledgement within two working days. We will not take legal action against anyone who reports in good faith, and we credit reporters publicly unless they prefer otherwise.

• api.ismartexams.com — the platform API
• www.ismartexams.com — this website
• master.ismartexams.com — the administration dashboard
• Institute portals on *.ismartexams.com subdomains
• The iSmartExams Android and iOS applications

Third-party services we depend on — payment providers, our SMS gateway, our hosting provider — should be reported to them directly, though we are glad to be told as well so we can follow up.

Ranked by how seriously we treat a report:

• Anything exposing an answer key before an attempt is submitted.
• Anything letting a user modify their own or another user's score, rank or attempt.
• Authentication bypass, OTP interception or account takeover.
• Access to another user's personal data or attempt history.
• Cross-tenant access between institute portals.
• Subscription or payment bypass.
• Remote code execution or server-side injection anywhere.

The first two matter disproportionately here. The entire value of our analytics, leaderboards and rank prediction rests on scores being trustworthy.

• Denial of service, volumetric or otherwise. Please do not.
• Social engineering of our staff, our users or our partners.
• Physical access attempts against our offices.
• Missing security headers with no demonstrated impact.
• Automated scanner output submitted without a working proof of concept.
• Reports that require a rooted or jailbroken device plus physical access.
• Best-practice suggestions with no exploitable consequence.

Test against your own accounts and your own data. Specifically:

• Do not access, modify or exfiltrate another user's data. If you can prove access, stop there and describe it.
• Do not degrade the service for real candidates. Some of them are preparing for an exam next week.
• Do not use a finding to gain a competitive advantage on a leaderboard.
• Give us reasonable time to fix an issue before disclosing it publicly — ninety days is our expectation, and we will usually be much faster.

Stay within these and we will treat your research as authorised.

• A human acknowledgement within two working days, not an automated receipt.
• An initial assessment and severity rating within five working days.
• Regular updates until it is resolved, without you having to chase.
• No legal action against good-faith research conducted within the rules above.
• Public credit in our security acknowledgements, unless you would rather remain anonymous.

We do not currently run a paid bounty programme. We say that plainly rather than implying one might materialise.

• TLS on every endpoint. No unencrypted transport anywhere.
• Answer keys held server-side and never sent to a device before submission.
• Scoring, ranking and analytics computed server-side against those hidden keys.
• Per-attempt question and option shuffling.
• Submission timestamp validation, rejecting replayed or out-of-window attempts.
• Rate limiting on authentication, with stricter limits on OTP endpoints.
• bcrypt password hashing where an account has a password at all.
• Role-based access control across the administration dashboard, with an audit log of every action.
• Least-privilege access to production data, limited to staff who need it.

If a security incident affects your data, we will tell you what happened, what information was involved and what we are doing about it — promptly, and without waiting to establish whether anyone had noticed.

Notification will describe the actual scope rather than a minimised version of it, and will include what you should do, if anything.

Email hello@lacspace.com with:

• What the issue is and where.
• Steps to reproduce it, including any request or payload needed.
• What an attacker could actually achieve with it.
• Whether you intend to disclose publicly, and roughly when.

Reports in Nepali or English are equally welcome. If you would rather encrypt, ask us for a key and we will send one.

hello@lacspace.com for vulnerabilities. hello@lacspace.com for anything legal about a disclosure.

Lacspace Corporation Pvt. Ltd., Bhimsengola, Kathmandu, Nepal.