Acceptable Use Policy

01Purpose and Scope

1.1.This Acceptable Use Policy (the "Policy") forms part of our Terms of Service. Capitalized terms not defined in this Policy have the meanings given in the Terms.

1.2.The Academy provides deliberately vulnerable environments for training purposes. This Policy defines which systems you are authorized to test and the conduct that is prohibited throughout the Service.

02Authorized Testing

2.1.You are authorized to test only:

• (a)a Session that you have deployed, while it is running, through the address provided to you by the Academy for that Session; and
• (b)within that Session, the services, files and accounts that form part of the Lab.

2.2.No other testing is authorized under this Policy.

03Systems Outside Scope

3.1.The following are outside the scope of authorized testing:

• (a)Sessions deployed by other users, even if they are reachable from your Session;
• (b)the Academy platform, including academy.duckurity.com, its API, its database and its sign-in system;
• (c)duckurity.com, the infrastructure that runs Labs, and any other system or account operated by Duckurity;
• (d)the service providers listed on our Subprocessors page; and
• (e)any other system on the internet.

3.2.If you discover a way to leave your Session, or a vulnerability in any system outside scope, you must stop immediately and report it in accordance with our Vulnerability Disclosure Policy. Good-faith reports made under that policy are welcome and protected by its safe harbor. Exploiting such a vulnerability is a breach of this Policy.

04Prohibited Conduct

You must not:

• (a)escape the sandbox, including by pivoting from a Session to another Session, to our infrastructure or to the internet, or by using a Session to scan, attack, spam or relay traffic to any third party;
• (b)disrupt the Service, including through denial-of-service activity against a Lab or any other system, cryptocurrency mining, running unrelated workloads, or keeping Sessions active to reserve capacity;
• (c)share solutions to private Labs, including flags, markers or step-by-step solutions. Writeups for community Labs are permitted in accordance with the Terms;
• (d)submit work that is not your own, including flags obtained from another user's Session or writeups describing Sessions that are not yours;
• (e)operate multiple Accounts to obtain additional free usage, trials or ranking advantages;
• (f)automate scoring, including scripts that guess or bulk-submit flags or circumvent rate limits. Automation within your own Session as part of solving a Lab is permitted;
• (g)impersonate Duckurity staff, another user or an Organization you do not represent;
• (h)harass or harm others, including through threats, hate speech or the disclosure of another person's personal data in names, writeups or any other Content; or
• (i)break the law, including by using skills learned in the Academy against systems you are not authorized to test.

05Use of AI Tools

5.1.You may use AI tools to assist your reasoning and to improve the wording of writeups. Flags must be obtained from your own Session, and the evidence section of a writeup must reflect the actual requests and responses from that Session.

06Enforcement

6.1.Depending on the seriousness of a breach, we may issue a warning, remove solves, Receipts or certificates, suspend your Account, or terminate it. Where activity targets systems outside scope, we may also report it to the competent authorities.

6.2.You may request a review of an enforcement decision as described in section 16 of the Terms of Service.

07Questions

If you are unsure whether an activity is permitted, please contact us at support@duckurity.com before proceeding.