Terms of Service

1. About these terms

These terms govern your use of vulnera.om, its subdomains (such as labs.vulnera.om), the free tools, labs, competitions, player accounts, blog, Weekly Threat Brief and threat intelligence pages (together, "the site").

The site is operated by Al Karmel Heights Trading L.L.C ("Vulnera", "we", "us"), a company registered in the Sultanate of Oman under commercial registration number 1222893, with its registered address at South Al Khuwair, Bousher, Muscat, Sultanate of Oman.

By using the site you agree to these terms, to the Acceptable Use Policy (which applies to the free tools and labs and is part of these terms) and to any rules published for a specific competition. If you do not agree, please do not use the site.

How we handle personal data is explained in our Privacy Notice and Cookie and Storage Notice.

Paid services are separate. Penetration tests, red team engagements and other professional services are provided only under a written contract signed with us. If that contract conflicts with these terms, the contract wins.

2. Using the site

You may use the site for your own information, learning and work, in line with these terms and the law. You must not:

• break the law, or help anyone else to, through the site;
• try to gain unauthorised access to the site, its servers or its accounts, or test the site's own security outside our responsible disclosure policy;
• interfere with the site, for example by overloading it, getting around rate limits or blocks, or introducing malicious code;
• scrape or copy the site in bulk by automated means, except for the RSS feeds, which are there for that purpose, and normal search engine indexing;
• pretend to be someone else, or misrepresent your connection with anyone;
• use the site to send spam or harass anyone.

We may change, suspend or withdraw any part of the site at any time, for example for maintenance, security or because a feature is retired.

3. Player accounts

• Age: you must be at least 18 years old to create a player account. By creating one you confirm that you are.
• One person, accurate details: an account is for one person. Give accurate details and keep your email address up to date.
• Security: keep your password and passkeys safe and do not share your account. Tell us at info@vulnera.om if you think someone else has used it. You are responsible for what happens on your account unless it happens because of our failure.
• Handle and public information: your handle and display name appear on leaderboards and competition results. Choose a handle that is not offensive and does not impersonate anyone. Your profile page is private unless you make it public.
• Deleting your account: you can delete your account at any time in your account settings. The Privacy Notice explains what happens to your data.

4. Free tools, labs and competitions

• Acceptable use: the free tools and labs may only be used as the Acceptable Use Policy allows. In short: only test systems you own or are authorised to test, and in labs only attack the targets we provide.
• Informational only: tool results are automated, may be incomplete or out of date, and are not a penetration test, a security assessment or a guarantee that a system is secure.
• Limits: tools and labs are rate limited and may be unavailable at times. We may change or remove them.
• Competitions: each competition has its own rules (eligibility, scoring, prizes and disputes), published with the event. Those rules apply in addition to these terms and win if they conflict with them.

5. Security information is not professional advice

The blog, Weekly Threat Brief, threat intelligence pages, Findings Explorer, Exposure Advisor, configuration generators and tool results are general information, provided as they are. They are not professional advice for your situation, and following them does not make a system secure. Decide what to do with your own qualified people or engage us under a contract. We become responsible for advice to you only under a signed engagement.

Threat information changes quickly. Vulnerability data comes from public sources such as the U.S. National Vulnerability Database and the CISA Known Exploited Vulnerabilities catalogue, and may contain errors or be out of date. Always check the vendor's own advisory before acting.

6. Intellectual property

• Our content: the site's text, design, graphics, logos, software, reports and samples belong to us or our licensors. You may view and print pages and share links to them. You may quote short extracts with attribution and a link. Anything else, such as republishing whole articles, needs our written permission.
• Our name and logo: "Vulnera" and our logos are ours. Do not use them in a way that suggests we endorse you or your product.
• Other companies' names: Cisco, Fortinet, Microsoft and the other product and company names on the site are trademarks of their owners. We use them only to describe the products and services we work with. Vulnera is not affiliated with or endorsed by those companies unless we say so. Client and partner logos are shown with their permission.
• Breachdex: the Breachdex entries summarise public reporting of past security incidents, each with a link to its source. They describe past events and are not a judgement of any organisation today. If you spot an error, tell us at info@vulnera.om and we will correct it.
• Open-source software and data: some parts of the site use open-source software and open data under their own licences, for example the DB-IP Lite database (Creative Commons Attribution 4.0) used by the IP geolocation tool.

7. Content you give us

If the site lets you add content, such as a profile, a bio, a write-up or a competition submission, you keep ownership of it. You give us a worldwide, royalty-free, non-exclusive licence to host, store, display and adapt it for the site for as long as it is on the site, and for a reasonable time afterwards in backups. You confirm that you have the right to share it and that it does not break the law or anyone's rights. We may remove content that breaks these terms.

If you send us feedback or ideas, we may use them without any obligation to you.

8. Third-party links and headlines

The site links to other websites, including our social media pages, vendor advisories, and the sources of the Weekly Threat Brief and the Breachdex. We do not control those sites and are not responsible for their content, availability or privacy practices.

The Weekly Threat Brief shows headlines, dates and links taken from the public RSS feeds of the named sources, with the source's name next to each item. We store only the headline, the link and the date, never the article itself, and the articles belong to their publishers. A publisher who wants its items removed can write to info@vulnera.om and we will stop using its feed.

9. Disclaimer

To the extent the law allows, the site and everything on it are provided "as is" and "as available", without any promise that they will be accurate, complete, uninterrupted, error-free or fit for a particular purpose. Nothing in these terms limits a right you have by law that cannot be limited by agreement.

10. Limitation of liability

Nothing in these terms excludes or limits liability that the law does not allow to be excluded or limited, such as liability for death or personal injury caused by negligence, or for fraud or wilful misconduct.

Subject to that:

• we are not liable for indirect or consequential loss, or for loss of profit, revenue, business, goodwill or data, arising from your use of the site;
• we are not liable for loss caused by your own use of tool results, security information or configurations from the site, or by testing systems you were not authorised to test;
• because the site's free features are provided free of charge, our total liability to you arising from the site in any 12-month period is limited to OMR 100.

These limits do not apply to paid services, where the engagement contract sets our liability.

11. Indemnity

If you break these terms or the Acceptable Use Policy, or use the site against the law or against someone else's rights (for example by scanning a system without permission), and someone makes a claim against us because of it, you agree to cover our reasonable losses and costs from that claim, to the extent the law allows. This does not apply to the extent the loss was caused by us.

12. Suspension and termination

We may suspend or close an account, block access from an IP address, or remove content, without notice where we reasonably believe it is needed to protect the site, its users or others, to comply with the law, or because these terms or the Acceptable Use Policy have been broken. Where it is safe and lawful, we will tell you why and how to contact us about it.

You can stop using the site and delete your account at any time. The sections on intellectual property, disclaimers, liability, indemnity and governing law continue to apply after that.

13. Governing law and courts

These terms and any dispute about them or the site are governed by the laws of the Sultanate of Oman. The courts of Muscat have jurisdiction.

If you use the site as a consumer and live elsewhere, you also keep the protection of the mandatory laws of the country where you live, and you may be able to bring a claim in your local courts. Nothing in this section takes that away.

Before going to court, please contact us at info@vulnera.om so we can try to resolve the problem.

14. Changes to these terms

We may update these terms, for example when we add features or the law changes. Each version has an identifier and an effective date, shown at the top of this page. If we make a significant change, we will say so on the site, and signed-in players may be asked to accept the new version. If you keep using the site after a change takes effect, the new terms apply to you.

15. General

• If a court finds part of these terms unenforceable, the rest still applies.
• If we do not enforce a right straight away, we can still enforce it later.
• You may not transfer your rights under these terms to anyone else. We may transfer ours to a company that takes over the site, and your rights are not reduced by that.
• These terms are written in English. If we publish a translation and it differs, the English version applies to the extent the law allows.

16. Contact

Al Karmel Heights Trading L.L.C , South Al Khuwair, Bousher, Muscat, Sultanate of Oman, Sultanate of Oman. Email info@vulnera.om. Security and abuse reports: info@vulnera.om.

17. Version

Version terms-v1, effective 28 September 2026.