How labs and accounts are protected
You come here to attack machines. This page explains how those machines stay yours alone, how your flags and account are protected, and where your data lives.
Every session gets its own network
Each lab session runs on an isolated network. Only your VPN reaches it, and there is no route from one learner's session to another.
Isolated per session
Your machines sit on a network of their own. Only your VPN connection reaches them.
Destroyed when you finish
Machines are destroyed when a session ends. The next launch starts from fresh machines.
Your work is kept apart
Notes, flags, progress and reports live on your account, not on the lab machines.
Flags are stored as keyed hashes
Never in plain text.
When you submit a flag, it is hashed with a secret key and compared with the stored hash. The flag itself is not kept, so a copy of the database would not reveal anyone's flags.
A flag only counts in the session it came from, so one copied from someone else's run is no use in yours. Sharing flags is against the acceptable use policy.
Accounts
Your account holds your progress and your reports. Here is how it is protected.
Two-factor sign-in
Use an authenticator app, with recovery codes as a backup.
Security changes are confirmed
Changing your password, two-factor setup or linked sign-in needs a fresh confirmation, and we email you each time. With two-factor on, only your authenticator or a recovery code can confirm.
Payments through Stripe
Card details go straight to Stripe. We never see or store your full card number.
Where your data lives
Rootpanther is hosted on Microsoft Azure in Western Europe.
The services we rely on, and what each one does, are listed on the subprocessors page. How we collect and use personal data is in the privacy policy.
Report a vulnerability
Found a security problem in Rootpanther itself? Tell us and we will fix it.
We acknowledge reports within 3 working days and keep you updated until the fix ships.
What to include
What you found, the steps to reproduce it, and what someone could do with it.
In scope
rootpanther.com, app.rootpanther.com and other rootpanther.com services.
Out of scope
The machines inside your lab, which are there to be attacked. Other learners' sessions, denial of service, social engineering and physical attacks.
Ground rules
Do not access other people's data. If you see some, stop and tell us. We will not pursue good-faith research that follows these rules.
Start on the free plan
Primers, drills and Onyx cost nothing. Start the 7-day trial when you want your first lab.