Acceptable Use Policy

The same technical knowledge can be used to defend a system or to break into one. We accept the first; we forbid the second. The simplest test:

• Do you have explicit, documented permission to test the target system?
• Is the target a Platform-provided lab, CTF, or your own infrastructure?

If the answer to either is yes — you're welcome here. If the answer to both is no, you are misusing the Platform.

You may use the Platform to:

• Solve our Capture-the-Flag (CTF) challenges, vulnerable labs, multiplayer rooms, and tournaments.
• Ask and answer questions about offensive and defensive techniques, including reverse engineering, exploit development, malware analysis, OSINT, red-teaming, and blue-team operations.
• Publish writeups for CTFs, public bug-bounty programmes, conference challenges, your own research, and CVEs disclosed by their owners.
• Share open-source tools, payloads, and exploits that are already public (e.g. Metasploit modules, public PoCs for patched CVEs).
• List or buy defensive, educational, or research-oriented content on the marketplace (training courses, defensive tooling, hardening guides, dev-friendly payloads for use against systems you own or are authorised to test).
• Network with peers, mentors, and recruiters; apply for or post legal cybersecurity jobs.
• Discuss, recommend, and review legal security tools and services.

You must not use the Platform (or anything you learn here) to:

(a) Attack systems without authorisation. Probing, scanning, exploiting, or disrupting any computer system, network, application, account, or device that you are not the owner of, or for which you do not have written authorisation, is strictly prohibited — whether that target is named on the Platform or not. "I'm just curious" is not authorisation.

(b) Buy, sell, or distribute weaponised or stolen material. Including but not limited to:

• Stolen credentials, "fullz", combolists, dumped databases, or any data obtained through unauthorised access.
• 0-day exploits aimed at production systems, weaponised exploit kits, ransomware kits, RAT builders, crypter / packer services, botnet panels, stealer logs.
• Phishing kits, scampage templates, or any infrastructure designed to defraud end users.
• Carding tools, payment-fraud tutorials, money-laundering services.
• DDoS-for-hire ("booter" / "stresser") services or instructions for them.
• Cracked or pirated commercial software, keygens, licence-bypass tools.
• Child sexual abuse material (CSAM) or any content sexualising minors — absolute prohibition; offences reported to authorities.

(c) Target specific real people or companies. Do not request, share, or use the Platform to plan attacks on a named third party, doxxing, stalking, harassment, swatting, or non-consensual surveillance.

(d) Bypass authorisation in our own systems. Do not attempt to access, modify, or interfere with parts of the Platform you are not authorised to use, including other users' accounts, paid content you have not purchased, or our admin tooling. Responsible-disclosure research on our own infrastructure is welcome — please email legal@hacking.community first.

(e) Distribute malware or malicious payloads. Hosting active malware, command-and-control infrastructure, drive-by-download links, or links to compromised sites is prohibited. Academic samples must be clearly labelled and shared in inert / defanged form.

(f) Engage in fraud, money laundering, or sanctions-evasion. Including using the marketplace, job board, or marketplace payouts to move illicit funds.

(g) Spam, scrape, or game the system. No mass unsolicited messages, vote manipulation, fake accounts, karma farming, AI-generated content posted at scale to dominate rankings, or scraping of Platform content beyond what our public API and GraphQL endpoint allow.

(h) Impersonate others. Do not impersonate another user, a public figure, a company, or HACKASTRA INFOSEC L.L.C-FZ staff. Verified accounts that are later found to be impostors will be terminated.

(i) Violate export controls or sanctions. The Platform may not be used in or for the benefit of persons or jurisdictions subject to comprehensive UAE, UN, EU, UK, or US sanctions.

Some content is borderline: detailed exploitation of unpatched popular software, payloads obviously dual-use, scraped-but-public datasets. We may, at our sole discretion, ask you to remove or rewrite such content, add safety caveats, gate it behind authentication, or move it to the private/marketplace section. We will explain our reasoning.

Bug-bounty writeups must be either (a) authorised by the program owner, (b) for an already-publicly-disclosed report, or (c) about your own systems.

If you find a vulnerability in hacking.community, please report it privately to legal@hacking.community before disclosure. Good-faith research that follows our responsible-disclosure rules will not be pursued under our Terms. Once we've fixed and credited you, you're welcome to publish a writeup here.

Out of scope: social engineering of staff, denial-of-service against production, attacks on live user accounts, anything that disrupts service for other users.

We may, at our sole discretion and without prior notice:

• Remove or hide content that violates this AUP.
• Suspend or permanently ban accounts.
• Reverse marketplace transactions and refund buyers.
• Cooperate with law enforcement, including providing logs and account data on lawful request.
• Report illegal activity (in particular CSAM, financial fraud, terrorism-related content) to the relevant authorities.

The severity of the response is proportional to the violation. First-time minor breaches get a warning; deliberate or repeated breaches get permanent bans.

If you see content or behaviour that breaks this AUP, please use the in-app report button on the offending post, listing, or profile. For urgent or sensitive reports (CSAM, threats of violence, credible criminal activity) email legal@hacking.community immediately.

We update this AUP as the threat landscape evolves. The effective date at the top reflects the latest version.