Acceptable Use Policy

1. Why this policy exists

Our free tools and labs are real security tools. Some of them send traffic to systems on the internet, and the labs teach attack techniques. Used without permission, the same techniques can be a crime, for example under Oman's Cyber Crime Law (Royal Decree 12/2011) or the UK Computer Misuse Act 1990, and similar laws in other countries.

This policy sets the rules for using them. It is part of our Terms of Service, and it applies to everyone who uses the tools or labs, with or without an account.

2. The one rule that matters most

Only test systems you own, or that you have permission to test from the person or organisation that owns them.

"Permission" means the owner has agreed, preferably in writing, that you may test that specific system in that way. Permission from a hosting company, a colleague or a client to test one system does not cover another system, and permission to test does not cover attempts to cause damage.

If you are not sure you have permission, do not run the tool.

3. What the authorisation confirmation means

Before the port scanner and the subdomain finder run, we ask you to tick "I own this target or am authorised to test it, and I accept the Acceptable Use Policy". By ticking it you confirm, for every target you enter for as long as it stays ticked, that:

• you own the target, or have the owner's permission to test it in this way;
• you have read and accept this policy.

The confirmation lasts until you close the browser tab or undo it. It is sent with each run with the time you gave it and, together with our record of the run, it is our record that you took responsibility for the target. The same rule applies to every other server tool, even those that do not ask.

4. What you must not do

With the tools and labs, you must not:

• scan, probe or test any system without the owner's permission;
• try to break into, disrupt, overload or damage any system, including ours;
• use the tools to find targets for an attack, or to support any attack, fraud or other crime;
• get around rate limits, IP blocks or our protections against reaching internal networks, for example by rotating IP addresses, using many accounts or automating runs;
• use the tools against our own site or infrastructure, except as our responsible disclosure policy allows;
• enter other people's passwords or other secrets into any tool;
• resell or build an automated service on top of the tools.

In the labs, you must also:

• attack only the targets we provide for that lab, and not our platform, other players' environments or anything on the internet;
• not try to escape a lab environment or move from it to other systems;
• not share flags or solutions for a live competition until it has ended, or break the competition's own rules;
• report any weakness you find in the lab platform itself to security@vulnera.om instead of using it.

5. Rate limits

Server tools are rate limited per IP address. At the time of writing:

Tool	Limit
Port scanner	One scan at a time, 2 per minute
Subdomain finder	2 in a burst, 4 per minute
Other server tools	10 in a burst, 30 per minute

We may change these limits at any time. The current limit is shown under each tool. Labs have their own limits, such as how many environments you can run at once and for how long.

6. What we log and why

For every run of a server tool we record the tool, the target you entered, your IP address, your player account if you are signed in, whether it succeeded, how long it took and the time. We never store the results, and the password strength checker never records the password. We keep these records for 30 days, and a matching entry in our activity log for 90 days, so that we can investigate complaints about misuse. Details are in our Privacy Notice.

7. Abuse blocking

Our systems block automatically, for a period, IP addresses that trip our abuse rules, for example by repeatedly hitting rate limits or triggering security checks. We may also block IP addresses, suspend or close accounts, disable a tool, or withdraw access to the labs by hand where we see misuse or receive a credible complaint. Where it is safe and lawful, we will tell you why.

8. Cooperation with owners and authorities

If the owner of a system complains that one of our tools was used against it, we will look into it using the records above. We may tell the owner that a run came from our tools and when, and we may share the records with the owner or with law enforcement or other authorities when the law requires it or we receive a lawful request. We do not tell people who ran a tool unless the law requires it or we believe it is needed to stop serious harm.

9. No guarantees

Tool results are automated and informational. They may be incomplete or wrong and are not a penetration test or proof that a system is secure. See section 5 of the Terms of Service.

10. Reporting abuse

If you think one of our tools has been used against your systems, or you see the tools or labs misused, email security@vulnera.om with:

• the IP address or domain that was targeted;
• the date and time (with time zone) of the activity;
• any logs you can share.

We aim to acknowledge reports within 5 business days, the same as for vulnerability reports on our security page.

11. Version

Version aup-v2, effective 12 October 2026.