Code of conduct

1.Who this applies to

This code applies to everyone with an account on root-me.cloud: researchers, program teams and the platform’s own staff. It covers reports, comments, profiles, program pages and updates, the capture-the-flag event, and any conversation that starts here and continues elsewhere.

It sits alongside each program’s policy and our disclosure guidelines. Breaking a program’s rules of engagement is also a breach of this code.

2.Be respectful

Security work involves disagreement: about severity, about duplicates, about whether something is a vulnerability at all. Disagree with the finding, not the person.

• No harassment, insults, threats, discrimination or sexual content, in any form.
• No pressure campaigns: do not flood a report with comments or chase team members through other channels.
• Do not publish or share anyone’s personal information without their consent.
• Be patient with people working in another language or time zone than yours.

3.Test within the rules

Authorization to test comes only from a program’s policy, and only for what it lists. In particular:

• Test only assets that are in scope, and follow the instructions attached to each one.
• Do not degrade the service: no denial of service, load testing, mass automated scanning or spam, unless the policy explicitly allows it.
• No social engineering of staff or users, no phishing and no physical attacks.
• Use accounts you own or that the program provided. Never access, change or delete other people’s data.
• When you reach sensitive data, stop, take only what proves the issue, and say in the report what you saw. Do not pivot further into the network.
• Delete any data you obtained once the report is closed, unless the program asks you to keep it.

4.Send honest, useful reports

• Report only issues you have verified yourself. Do not submit unconfirmed scanner or tool output.
• Do not submit reports written by someone else, copied from public sources, or generated without checking that every claim and step holds.
• Describe the impact you can demonstrate, not the worst case you can imagine.
• Do not split one issue into many reports, or resubmit a report that was closed, to gain reputation.

5.Keep reports confidential

Everything in a report, from the vulnerability to the team’s replies, stays between the reporter and the program team until the report is disclosed through the platform. That is true for researchers and for program teams alike: teams do not share a reporter’s findings or personal details outside the people who need them to fix the issue.

6.No demands, no threats

Rewards are set by a program’s published table, or are not offered at all for disclosure programs. Never make payment, or anything else, a condition for sharing details, for not publishing or for not exploiting an issue. Demands of this kind are extortion: we remove the account and may report it.

Asking a question about a program’s rewards in a respectful way is fine. Repeated pressure is not.

7.Play fair with reputation

• One account per person. Do not share accounts or create new ones to escape a penalty.
• Do not collude with others to inflate reputation, trade findings, or submit someone else’s work.
• Do not vote on Hacktivity entries with several accounts.

8.Program teams

Programs ask researchers for a lot of trust. In return, program teams:

• respond to reports within their published targets and keep reporters informed;
• assess every report on its merits and explain their decisions, especially when closing a report;
• credit the first valid report of an issue and pay published rewards for bounty programs;
• do not threaten or pursue legal action against researchers who acted in good faith and within the policy;
• keep their policy, scope and safe harbor statement accurate, and post an update when they change.

9.Reporting a problem

If someone breaks this code, in a report thread or anywhere else, contact the platform team with a link to what happened. We read every message, keep the identity of the person who raised it confidential where we can, and do not tolerate retaliation against anyone who reports a concern in good faith.

10.Enforcement

We choose a response proportionate to what happened, taking intent and history into account:

• a private warning;
• closing the report as spam, which costs 10 reputation, or as not applicable, which costs 5;
• removing content, such as a comment, a profile field or a program update;
• a temporary or permanent ban, which signs the account out and blocks it from the platform and the CTF.

Serious cases, such as extortion, data theft or attacks outside any policy, lead to an immediate ban and may be reported to the organization affected or to the authorities. If you believe a decision was wrong, contact us and we will review it.