Break The Root
We value the contributions of the security research community and take platform security seriously, which matters more to us than most, given what we build. If you've discovered a security vulnerability in our platform, we encourage you to let us know. We welcome the opportunity to work with you to resolve it promptly.
Our program follows Coordinated Vulnerability Disclosure, Safe Harbor, Open Scope, and Core Ineligible Findings standards.
A Note on Scope, Specific to Break The Root
Break The Root is a cybersecurity training platform where users are given deliberately, intentionally vulnerable machines to exploit as part of the learning experience. Because of this, scope clarity matters more here than on a typical VDP:
In scope: our actual platform infrastructure, the main website and web application (breaktheroot.com), our authentication and account systems, our API, our VPN provisioning and session-isolation infrastructure, our payment processing integration, and any way one user's lab session could affect, access, or interfere with another user's session, account, or data.
Out of scope: the intentionally vulnerable machines themselves, within an active lab session. Finding and exploiting the vulnerability a given lab was built around is the point of the platform, not a security issue to report. If you're unsure whether something you've found is an intentional part of a lab's design or an actual platform vulnerability, report it anyway, we'd rather review a false positive than miss something real.