Cookie and Storage Notice

1. The short version

• We use a few strictly necessary cookies and browser storage entries to keep the site secure, keep you signed in and remember your cookie choice. These do not need your consent.
• With your consent ("Accept") we also remember a few conveniences on your device, such as your recent tool inputs and your easter egg progress. If you choose "Essential only", or make no choice, none of these are kept beyond the current browser tab.
• We use no analytics, advertising or social media cookies, and the site loads no scripts, fonts or images from other companies.
• The only cookies set by another company are the security cookies of Cloudflare, the network provider that protects our servers.

This notice is part of our Privacy Notice. It is operated by the controller named there.

2. Your choice and how to change it

The first time you visit, a small notice at the bottom of the page offers two equal buttons: Essential only and Accept. Nothing optional is stored until you choose Accept, and the notice never blocks the page.

You can change your choice at any time with Cookie settings at the bottom of every page. Choosing "Essential only" later deletes every optional entry listed in section 4 and the vh_seen cookie.

Your choice is stored in the v_consent cookie for 180 days. After that, or if we add a new optional purpose, we ask again.

You can also delete cookies and site data in your browser settings at any time. If you delete the strictly necessary cookies you will be signed out, and some features, such as forms and tools, will set them again when you use them.

3. Strictly necessary

These are needed for the site to work securely, or to do something you asked for. They do not need your consent.

Cookies

Name	Purpose	How long
vp_access, vs_access	Keep a player (vp) or staff member (vs) signed in	15 minutes, renewed while you use the site
vp_refresh, vs_refresh	Renew the sign-in without asking for your password again	Players: 7 days without use, 30 days at most. Staff: 8 hours
vp_csrf, vs_csrf	Protect forms, tools and account actions against cross-site request forgery	30 days
v_consent	Remember your cookie choice	180 days
__cf_bm	Set by Cloudflare to tell people from automated bots	30 minutes
cf_clearance	Set by Cloudflare only if you pass a security challenge, so it is not shown again	Usually 30 minutes

Our own cookies are first-party, marked Secure (sent over HTTPS only) and SameSite=Lax. The sign-in cookies are HttpOnly, so page scripts cannot read them.

Browser storage

Name	Purpose	How long
vtools_attest, vtools_attest_at	Record, for this tab only, that you confirmed you are authorised to test a target with our tools, and when	Until you close the tab
vexposure	Keep your Exposure Advisor answers while you fill in the questions	Until you close the tab
vp_seen	Remember that a signed-in player used this browser, so the menu shows the right state. It holds no identifier and is removed when you sign out	Until you sign out
vcisco, v_ann_dismissed, vlabs, vlabs_coach, vacad	Before you choose Accept: your Cisco Config Generator draft, the announcements you closed, and your labs and Academy progress without an account	Until you close the tab

Staff using the admin area also get a tab-only entry named vulnera.brief.intro. followed by an id, which passes text from one admin screen to another.

4. Optional, only with your consent

These make the site more convenient. They are kept in your browser and never sent to other companies. Two of them, vlabs and vacad, are also sent to our own servers when you play a lab, answer an Academy check or add your progress to an account. They are stored only after you choose Accept.

Name	Purpose	How long
vtools_hist:*	Your last 5 inputs for each tool, so you can rerun them. Never passwords, never results	7 days
vsearch_recent	Your last 8 site searches	Until you clear it
vcisco	Your Cisco Config Generator draft, kept across visits. Never secrets	Until you clear it
v_ann_dismissed	The announcements you closed, so they stay closed	Until you clear it
vh_seen (cookie)	The home page scenes and lines you have already seen, so you see new ones	30 days
vsp, vscl	The same memory of scenes and lines, kept in the browser	Until you clear it
vdex, veggs, veggr, vdexseen, vdexhinted	Your easter egg and Breachdex progress	Until you clear it
vhinted, veggfound, vg_sins	Easter egg hints and counters for the current visit	Until you close the tab
vscs	The home page scenes you have collected	Until you clear it
vlabs	If you play Core labs without an account: a random identifier for this browser, the labs you solved and the hints you opened, so you can add them to an account later	Until you clear it
vlabs_coach	Whether you have closed the first-visit tips in the labs	Until you clear it
vacad	If you read the Academy without an account: the lessons you marked as read and the checks you passed	Until you clear it
vperf, vperft	Your Performance choice in the footer (Auto, Full, Balanced or Lite), and whether we have shown you the one-time note about it	Until you clear it
vperfp	The result of a short test of how smoothly your device draws the page, with your browser version and screen size so the test runs again when they change	7 days
vperfq	A ?perf= or ?lite= setting from the address, kept for the tab	Until you close the tab

"Until you clear it" means the entry stays in your browser until you choose "Essential only" in Cookie settings or clear your site data.

5. What we do not use

• No analytics, statistics or heat-map tools.
• No advertising, retargeting or social media cookies or pixels.
• No fingerprinting or other ways of recognising your device without cookies.
• No embedded content that sets its own cookies: videos and other third-party content are shown as links to the provider's own page.

Links to other websites (for example our LinkedIn page, the sources in the Weekly Threat Brief or the Breachdex) only contact those sites when you click them. Their own cookie rules then apply.

6. Changes

If we add, remove or change an entry, we update this notice. If we add a new optional purpose, we ask for your choice again.

7. Version

Version cookies-v2, effective 12 October 2026. Questions: privacy@vulnera.om.