the obvious questions

hacking.community is a hacker-first platform built around three things: Practice (hands-on labs, a multi-domain academy, an in-browser attack box, network labs and investigations), Compete (weekly CTFs, live multiplayer, worldwide competitions and hackathons, and a global leaderboard), and Hunt (a 900+ public bug bounty program directory and a security jobs board). It's for anyone leveling up practical offensive-security skills — from first CTF to full-time bug hunting.

Three ways. (1) It's free to start — the core labs, academy and directories don't sit behind a paywall. (2) It combines learning, competition and real opportunity in one place: practice a technique in a lab, prove it in a CTF, then go find a live program to apply it to in the bounty directory. (3) It links out honestly — the bounty directory and jobs board point you to real HackerOne / Bugcrowd / Intigriti / YesWeHack programs and real employers rather than walling you in.

Yes. Q&A, most of the hands-on lab catalogue, the academy, weekly CTFs, the leaderboard, the bug bounty directory, the security jobs board and encrypted DMs are all free. Pro ($12/mo or $99/yr) lifts AI-hint limits, unlocks all Hard labs, grants 50 AI hints a month and 2× XP while subscribed. Attack Box (real in-browser VMs, billed hourly) is coming soon.

Karma is your earned reputation. Grow it by answering questions (+10 per upvote), publishing writeups (+20), solving labs (+15–50 by difficulty) and shipping original CTF challenges (+50+). Karma unlocks features — 100+ to vote on the public roadmap, 500+ to mentor. It's public on every profile as proof of work.

You can browse the labs index, the academy, the bug bounty directory, the jobs board and public profiles without an account. To solve labs, submit CTF flags, earn karma, join multiplayer rooms or save bookmarks, sign up for a free account — it takes a few seconds.

The labs are guided, hands-on exercises spanning web, active directory, cloud, mobile, crypto, reversing, forensics, network, OSINT and more. Every lab runs in an isolated sandbox we own and operate — you practice against our infrastructure, never anyone else's, which keeps it fully legal. Each lab includes theory, real-world context and a public leaderboard.

The Academy is a structured, multi-domain curriculum that takes you from fundamentals to advanced, level by level, and maps onto career tracks like bug bounty hunter and red teamer. It's the 'learn the concept' half — the labs are the 'now do it' half. Browse it at /learn and follow a guided path at /tracks.

Attack Box is an in-browser hacking environment — a real Kali-style machine (Pwnbox) with full tooling (nmap, sqlmap, Burp and more) and live target machines you can get real root on. No local VM setup, no downloads. It's rolling out as a Pro add-on; you can preview it at /box and get on the list.

Network Labs (/network-labs) are multi-host scenarios where you pivot through a simulated network rather than a single target — closer to a real engagement. Investigations (/investigations) are blue-team and forensics/OSINT cases where you analyse evidence and piece together what happened. Both complement the single-target vulnerable labs.

Yes. You can sit skill exams and earn verifiable credentials at /certifications — each has a public verification page so anyone can confirm it's genuine. They're proof-of-skill tied to real hands-on performance, not multiple-choice memorization.

No — they're scaffolded. Tier 1 nudges direction, Tier 2 narrows the technique, Tier 3 (Pro) gives a concrete next step, and only the final tier reveals the answer and costs a credit. Most players never need the last tier. Solving with a hint still credits the lab but skips the first-blood badge.

New CTF-style challenges drop regularly at /ctf. Solve them solo or in the arena, submit the flag, and climb. Solves earn karma and XP, and fast solves earn first-blood badges. It's the quickest way to turn what you learned in a lab into a ranked, public result.

Multiplayer (/multiplayer) puts you in live head-to-head or team rooms racing to solve the same challenge in real time. It's fast, social and a great way to benchmark yourself against other hackers rather than a static leaderboard.

The Tournaments & Competitions hub (/tournaments) lists every upcoming CTF worldwide (via CTFtime) and cyber hackathon (via Devpost) — dates, format, prize pools and team counts, refreshed automatically. Tap the bell on any event to get a reminder before it starts, hit 'rally' to post a looking-for-teammates thread in the community, and sign up at the official event site. Nothing to host, nothing to miss.

The global leaderboard (/leaderboard) ranks hackers by karma and solves. It's fully public — your rank, badges and solved-challenge history double as a living résumé you can share anywhere.

The directory (/programs) is a live, daily-refreshed index of 900+ public bug bounty and vulnerability disclosure programs across HackerOne, Bugcrowd, Intigriti and YesWeHack. Each program has its own page summarising scope, platform and payout range, then links you straight to the official program to report. Nothing is hosted here — we point you to the real thing.

Browse or search /programs, filter by platform, and use the 'pays bounties' toggle to show only paid programs. Open a program page to check its scope and reward range, warm up your methodology in the relevant labs first, then head to the official program to test — always within its published scope and rules.

The jobs board (/jobs) aggregates remote and on-site cybersecurity roles from public sources and links out to the original employer listing to apply. It's a fast way to see who's hiring in security without hunting across a dozen job sites.

Free covers Q&A, CTFs, most labs, the academy, the bounty directory, the jobs board and encrypted DMs. Pro ($12/mo or $99/yr — ≈$8.25/mo, save 31%) adds all Hard-difficulty labs, 50 AI hint credits a month, SEC-OPS access with 6× AI rate limits, 2× XP while subscribed, Attack Box priority queue, larger uploads and a Pro badge. Attack Box (real in-browser VMs, billed hourly) is coming soon.

Credit/debit cards (Visa, Mastercard, Amex, Discover), Apple Pay, Google Pay and Link — all via Stripe Checkout. We accept USD only; Stripe handles conversion for non-USD cards with the standard ~3% FX fee. Bank transfer and crypto aren't currently supported.

Yes. Open Settings → Billing → Manage subscription → Cancel. You keep access until the end of the current billing period. We don't prorate partial periods — see the refund policy at /legal/refunds.

Yes — 50% off Pro for verified students (.edu email or proof of enrollment) and free Pro for active cybersecurity educators at a registered institution. Email education@hacking.community with proof; we re-verify yearly.

Fulfillment has a 3-layer safety net (webhook + polling + admin force-fulfill). If the success page hangs, refresh it — it auto-fulfills via polling within ~10 seconds. Still nothing after a minute? Email support@hacking.community with your session ID (in the URL after checkout) and we'll manually fulfill or refund within 1 business day.

Yes. DMs are end-to-end encrypted in your browser using ECDH-P256 + AES-GCM — even we can't read them. Anonymous visitors never see contact info on profiles.

Karma-gating on higher-trust actions, an admin moderation queue, two-factor TOTP for admins, spam-signal detection on submissions, and reports reviewed within 24h. We err on the side of removing bad actors fast.

A MongoDB cluster (AWS, US-East), encrypted at rest with AES-256. Stripe holds payment data — we never see your card number. All requests are served over TLS 1.3, and we never sell or share user data. Full detail at /legal/privacy.

Yes — Settings → Danger Zone → Delete account. We immediately remove your profile, posts, applications, listings and DMs from public view; backups containing your data age out within 30 days. Some anonymized, non-identifying data (aggregate counts, admin audit logs) is retained for security/legal reasons.

Yes. Report security issues to security@hacking.community using our PGP key (fingerprint on /legal/privacy). We reward accepted reports by severity plus credit on our hall of fame. Out of scope: purely theoretical issues, missing headers without demonstrated impact, and social-engineering of staff.