We welcome security researchers who help us keep our students safe. This policy explains what you may test, how to test it, and how to report what you find. It is the one exception to the rule in our Code of Conduct & Ethical Hacking policy against testing academy systems: testing that follows this policy is authorised.
1. What is in scope
- The Intrusion Academy website and app: the public site, student accounts, enrollment and payment flows, lessons and video delivery, and the dashboard login.
- Signal (the Windows executable).
- Signal Console.
2. What is out of scope
- Other people's accounts and data. Use only accounts you own, and never view, change or delete another person's data. If you reach someone else's data by accident, stop, do not keep it, and tell us.
- Third-party services we use (hosting, video delivery, email, InstaPay). Report their issues to them.
- Denial of service, load or stress testing, spam, and automated scanning that sends large numbers of requests.
- Social engineering or phishing of our staff, instructors or students, and any physical attack.
- Reports with no real security impact (for example missing headers with no exploit, self-XSS, or clickjacking on pages with no sensitive action).
3. How to test
- Test gently and only as much as needed to show the problem.
- Do not keep, copy or share any data you reach, and do not plant backdoors or leave changes behind.
- Test Signal and Signal Console only on machines you own or are allowed to test.
4. How to report
- Send your report privately through the Contact page, choosing the topic "Bug or vulnerability report". Include what you found, where, the steps to reproduce it and its impact.
- Keep it private until we confirm it is fixed. We aim to reply within 7 days.
5. Our promise
- If you follow this policy in good faith, we will not take legal action against you for your testing.
- Valid reports are credited by name (or by the handle you choose) in our Hall of Fame, if you want to be listed.
- At this time, we do not offer monetary bounties. Recognition in the Hall of Fame is our thank-you.
6. Hidden challenges
The academy sometimes hides puzzles and clues on its site. They are meant to be found by curiosity and solved with public, legal steps; they never ask you to attack the academy or anyone else. Solving one is not a vulnerability report, and finding a puzzle is not permission to test outside this policy.