Security

1. Our Philosophy

Hack n Roll teaches ethical hacking and security research. We believe the Platform itself should reflect those values: secure by design, transparent where possible, and open to responsible scrutiny.

Security is not a feature we bolt on at the end; it influences how we handle authentication, data storage, challenge validation, and community access controls.

2. Security Practices

We implement several measures to protect the Platform and its users:

• Passwords are hashed with argon2, never stored in plaintext.
• Authentication uses short-lived access tokens and secure HttpOnly cookies. See our Cookie Policy for details.
• Challenge solutions are verified using cryptographic mechanisms designed to protect flags and resist unauthorized comparison attacks.
• Rate limiting and other abuse-prevention mechanisms on sensitive actions such as login, registration, and flag submission.
• Infrastructure-level protections through providers such as Cloudflare (DNS, CDN, security) and AWS hosting. Those providers process traffic under their own terms; Hack n Roll does not control their independent processing.
• Deny-by-default authorization: every API route requires an explicit access policy.

We do not use third-party analytics or advertising trackers in the product. See our Privacy Policy and Cookie Policy for details on data collection.

3. Security Limitations

No system can guarantee perfect security. Hack n Roll continuously reviews and improves its security practices, but security risks cannot be completely eliminated.

4. Reporting Vulnerabilities

If you discover a security vulnerability in Hack n Roll, please report it through our Responsible Disclosure process. Email security@hacknroll.dev with a detailed description and reproduction steps.

• Do not exploit vulnerabilities beyond what is needed to demonstrate the issue.
• Do not access other users' data unnecessarily.
• Do not publicly disclose the issue before allowing reasonable time for investigation and remediation. Please coordinate with us before publishing details.

5. security.txt

We publish a /.well-known/security.txt file with current contact information, preferred languages, and links to our disclosure policy. This follows the standard defined in RFC 9116.

6. Your Role

Security is a shared responsibility. You can help by:

• Using a strong, unique password for your Hack n Roll account.
• Not sharing your account credentials with anyone.
• Protecting access to the email account associated with your Hack n Roll account, since it may be used for account recovery.
• Following our Challenge Rules: do not attack Platform infrastructure.
• Reporting suspicious activity or vulnerabilities through official channels.

7. Contact

For security reports: security@hacknroll.dev. For privacy and data questions: privacy@hacknroll.dev.