Skip to content
Learn more about root-me.cloud
Log in

root-me.cloud: Scope

Download CSVLast updated on
1-5 of 5
Assets of root-me.cloud
Asset nameTypeCoverageMax. severityLast updateResolved Reports

root-me.cloud

The primary web application and everything served from the apex domain.

DomainIn scopeCritical0 (0%)

www.root-me.cloud

The marketing site and the signed-in web application.

DomainIn scopeCritical0 (0%)

*.root-me.cloud

Any subdomain owned and operated by root-me.cloud is in scope, except the subdomains listed as out of scope below. If you are unsure whether a subdomain is ours, ask before testing.

WildcardIn scopeCritical0 (0%)

https://www.root-me.cloud/api

Public JSON endpoints of the platform (scoreboard, CTFtime export, announcements, files). Test them with your own account only.

APIIn scopeCritical0 (0%)

send.root-me.cloud

Out of scope: the outgoing email sub-domain, run by our email providers (Resend / Amazon SES). Report issues in those services to their own programs.

OtherOut of scopeNone0 (0%)

1-5 of 5

Rewards

This is a vulnerability disclosure program: it does not pay cash rewards. Every resolved report earns reputation and a public thank-you on the Thanks page.

SeverityReputation
Low+10 reputation
Medium+15 reputation
High+22 reputation
Critical+32 reputation

Earned when a report is resolved at that severity. How reputation works

Stats

Reports received | 90 days
0
Last report resolved
–
Reports resolved
0
Hackers thanked
0
Assets in scope
4