For security researchers
Hack with permission.
Get credit for every fix.
Every program on root-me.cloud tells you what you may test, how to report and what you get back. You do the research; the report thread, the response clock and your reputation take care of the rest.
What a closed report earns
Reputation, per report, when it closes
| Final state | Points |
|---|---|
| Resolved | +7 |
| Duplicate | +2 |
| Informative | 0 |
| Not applicable | −5 |
| Spam | −10 |
| If resolved | Bonus |
|---|---|
| Critical | +25 |
| High | +15 |
| Medium | +8 |
| Low | +3 |
A resolved critical earns +32: 7 for the fix plus the 25-point bonus. Open reports earn nothing yet.
- Public programs
- 11
- Reports resolved
- 0
- Reports disclosed
- 0
Why research here
Fewer surprises, faster answers, and a record of your work that belongs to you.
- Each program lists its in-scope assets with instructions and maximum severity, the findings it will not accept, and its rules of engagement. If it is not listed, it is not in scope.
Response you can measure
Programs publish response targets and their real averages: time to first response, to triage and to resolution. Response efficiency shows how often they answer within target (3 days unless they set their own).- Once a report is closed, you can ask to make it public. When the program agrees, it appears on Hacktivity with your name on it. Nothing is published without both sides.
- Resolved reports land on the program’s Thanks page, your public profile and the leaderboard. Your reputation, signal and impact sum up the quality of your work.
New to this? Warm up on the CTF.
The same account opens our capture-the-flag challenges: a safe place to practise before you touch a real target.
Reputation, signal and impact
Three numbers on your profile, all computed from your closed reports.
Reputation
The sum of what your closed reports earned: 7 for a resolved report plus a severity bonus, 2 for a duplicate, −5 for a report that was not applicable and −10 for spam.
Signal
Your average points per closed report, without severity bonuses. It ranges from −10 to 7: a perfect 7.00 means every report you closed was a valid, new finding.
Impact
Your average severity bonus per resolved report, from 0 to 25. It shows how serious the issues you get fixed are, not how many you send.
Rules of engagement, in short
Each program’s policy has the final word. These rules apply everywhere on the platform.
- Stay in scope. Test only the assets a program lists, and respect its exclusions and testing instructions.
- Do no harm. No denial of service, social engineering, physical attacks or spam. Use your own test accounts.
- Touch as little data as possible. Stop as soon as you can show the issue, never keep or share what you saw, and say in the report what you accessed.
- One issue per report. Clear steps to reproduce and a realistic impact. No unverified scanner output.
- Keep it confidential. Do not discuss a vulnerability outside its report until it has been disclosed through the platform.
- No demands. Never make payment a condition for sharing details or for keeping quiet.
Your next report starts with a policy
Read it, test within it, and report what you find.