Terms of service

1.About these terms

These terms govern your use of root-me.cloud, its bug bounty and vulnerability disclosure platform and its capture-the-flag event (together, the “service”). By creating an account or using the service you accept them. If you use the service on behalf of an organization, you confirm that you may accept them for it.

The code of conduct, the disclosure guidelines and the privacy policy are part of these terms. Each program’s policy adds rules for that program.

2.The service

root-me.cloud lets organizations publish programs that invite security research on assets they control, and lets researchers submit reports to those programs and follow them to resolution. We provide the platform and its workflow. Unless a program is marked as managed by the platform team, we do not decide whether a report is valid, how severe it is or whether it earns a reward: the program team does.

3.Your account

• You must be at least 16 years old, or older if the law where you live requires it.
• Give accurate information, keep your password secret and tell us if you suspect someone else is using your account.
• One person, one account. Accounts are personal and may not be shared, sold or transferred.
• The same account signs you in to the bug bounty platform and to the CTF.
• Your username, profile and public activity are visible to everyone; choose them accordingly.

4.Authorization to test

Creating an account does not authorize you to test anything. Authorization comes only from a program’s published policy, applies only to the assets it lists as in scope, and is subject to its rules of engagement and exclusions. A program may change its policy at any time; the version in force when you test applies.

Testing outside a program’s policy, or any system that is not part of a program, is not covered by these terms or by any safe harbor statement, and may be illegal. Safe harbor statements are commitments made by each program, not by root-me.cloud.

5.Acceptable use

You agree not to:

• attack the service itself, except through a program that lists it as in scope;
• access accounts, reports or data you are not entitled to see;
• overload the service, scrape it at scale or bypass its rate limits;
• post unlawful, infringing, malicious or misleading content, or links to it;
• use the service to harass anyone, to extort an organization or to trade vulnerabilities;
• impersonate another person or organization.

6.Reports and confidentiality

A report is visible only to its reporter and the program team until it is disclosed through the platform. Both sides keep its content confidential until then, as described in the disclosure guidelines. When a resolved report is not disclosed, Hacktivity shows only that a report from you was resolved, with the program and the date.

You keep ownership of what you write. By submitting a report or a comment, you grant the program and root-me.cloud a worldwide, royalty-free licence to use, reproduce and share it as needed to assess and fix the issue, to operate the service and, once the report is disclosed, to publish the disclosed parts. You confirm that you have the right to submit what you send and that it does not contain data you obtained beyond what was needed to demonstrate the issue.

7.Rewards and reputation

Vulnerability disclosure programs do not pay money; valid reports earn public thanks and reputation. Bug bounty programs publish a reward table, and the program team decides the amount within it. Rewards are owed by the program, not by root-me.cloud, and you are responsible for any taxes on them.

Reputation, signal, impact and rankings are calculated as described on the reputation page. They have no monetary value and we may correct them if they result from an error or from a breach of these terms.

8.Program teams

Organizations running a program confirm that they own or are authorized to open for testing every asset they list, keep their policy accurate, respond to reports in good faith, pay the rewards they publish, and honour the safe harbor statement on their program page. They are responsible for the decisions they take on reports.

9.Suspension and termination

You may stop using the service at any time and ask us to delete your account. We may remove content, close reports, reset reputation, suspend or ban an account when it breaks these terms, the code of conduct or a program’s policy, or when that is needed to protect users, organizations or the service. Where we can, we tell you why. Sections that by their nature should survive, such as confidentiality and the licence for disclosed reports, continue to apply.

10.Disclaimers

The service is provided “as is” and “as available”. We work to keep it secure and online but do not guarantee that it will be uninterrupted or error-free, that a program will respond within its targets, or that any report will be accepted or rewarded. Program pages are written by the programs; we do not verify every statement in them.

11.Limitation of liability

To the extent the law allows, root-me.cloud is not liable for indirect or consequential losses, for lost profits or data, or for the acts of programs and researchers. Nothing in these terms limits liability that cannot be limited by law, such as liability for gross negligence, wilful misconduct or personal injury.

12.Changes to these terms

We may update these terms as the service evolves. The date at the top of this page shows the latest version. When a change is significant, we announce it on the platform before it takes effect. Continuing to use the service after that means you accept the new terms.

13.Contact

Questions about these terms can be sent to the platform team.