Security you can audit, not just trust.
encrypt · verify · isolate · disclose.
We're a platform for hackers, so we hold ourselves to a hacker's bar. Messages are end-to-end encrypted, skills are lab-verified, analytics are opt-in, and every researcher has a real way to report a bug — with a bounty attached.
End-to-end encrypted
direct messages.
Hackers swap findings, payloads and write-ups in DMs without us — or anyone else — reading the contents.
ECDH-P256 key exchange
Every account holds an elliptic-curve keypair. Messages are encrypted in your browser to the recipient's public key — the server only ever sees ciphertext.
Per-recipient envelopes
Group threads encrypt a separate envelope for each member. No shared plaintext, no server-side fan-out of readable content.
Scrubbed on delete
Delete a message and the stored ciphertext is overwritten, not just flagged. What's gone is gone.
A skill model you can audit.
Anyone can claim "expert in web exploitation." On hacking.community, the claim is backed by evidence a company can actually check.
- Sibling-lab verification · Skills are demonstrated under observation on infrastructure we control — nobody can fake a shell.
- Karma-ranked reputation · Signal accumulates from real solves, writeups, and accepted findings, not endorsements.
- Identity verification (opt-in) · Stripe Identity gates access to private programs and sensitive flows.
- Integrity-scored reports · Every bounty submission carries an AI-fingerprint + coherence score to keep the signal high.
Lab-verified profiles
Verified badges map to solved labs anyone can inspect — the profile is the work, not a bullet list.
Escrow-backed bounties
Company payouts are held in Stripe escrow and released on triage approval. Hunters see a real number, not a promise.
Platform hardening.
The controls that don't make a demo but do keep your data safe.
Verified payment webhooks
Stripe events are signature-verified and re-checked against the Stripe API before any entitlement is granted. Forged webhooks are rejected at the door.
Brute-force protection
Login is rate-limited per account with automatic lockout; password-reset requests are throttled — keyed on the true client IP behind our edge.
Isolated accounts
User and payment data live behind strict per-account authorization — denied at the query layer, not just the UI.
SSRF-guarded fetches
Server-side image and link fetches resolve and block private, loopback and cloud-metadata addresses before making a request.
Secure sessions
HTTP-only, secure cookies with SameSite protection and server-side expiry + revocation. Stale tokens can't be replayed.
Continuous review
Passwords are bcrypt-hashed, secrets stay in environment config, and every release runs through code review and security regression tests before it ships.
We'd love to
hear about it.
We run an in-house bug bounty — report a vulnerability and you get tracked, scored, and (where the program is funded) paid. First-blood hunters are immortalised on our Hall of Fame. Sev1 triaged within 24 hours.
Practice, compete, and message with confidence.
The same people who build security tooling built this platform. It shows.