Terms, privacy and fair play

Terms of use

Playing the game. cyberhero.lol is run by its organizers ("we", "us") and is free to play. By creating a hero or playing, you agree to these terms and to the fair play rules below. If you don't agree, please don't play.

Your hero and your Hero Code. Your Hero Code is the only key to your hero: there's no email or password, and a lost code can't be recovered. Keep it secret, like a password: whoever has it can play as you. The organizers can give you a new code once they've made sure the hero is yours.

Names. Choose a nickname for your hero and your team: nothing offensive, nothing that pretends to be staff or someone else, and not your full real name. Hero names are public on the leaderboards.

Play nice. Please don't:

• attack, scan or overload the site, or try to get into anyone else's hero (it's a quiz, not a target; good-faith security research within the rules under Security is welcome),
• use bots, scripts, modified versions of the game or anything else that plays for you,
• take advantage of bugs (report them instead: Report a bug in the game's menu),
• harass other players through names, team names or emotes,
• break the fair play rules.

What the organizers can do. To keep the event fair and running, the organizers can rename, reset or remove any hero or team, and change, pause or end the game, its leaderboards or the Vulnerability Arena at any time: for example when the rules are broken, or to start everyone afresh after a test run.

Weekly champions. When each week of the event ends (at midnight at the end of Sunday, New York time), the hero with the most points is that week's champion, named on the title screen for everyone (with ties going to whoever solved more, then whoever got there first). The organizers can leave out a hero who broke these terms; the next hero on that week's board then takes the title.

Prizes. Any prizes are announced and run by the event's organizers, with their own rules. A hero who broke these terms can be left out.

The questions are for learning. The challenges teach general cyber-security awareness. They aren't professional, legal or security advice for your situation, and despite careful checking one might be wrong or out of date: tell us with Report a problem on its terminal. At work, your organization's own policies and IT team come first.

Real names, made-up characters. The challenges and the Vulnerability Arena mention real companies, products and vulnerabilities to describe real events and examples. Those names belong to their owners, who aren't connected with the game and don't endorse it. The characters, companies such as Hero Corp, and the web filter "Scaler" are made up: Scaler's block page in Wall-E Fire's quest is a 10-second drill, not a real block.

No guarantees. The game is provided as it is, without warranties of any kind. We do our best to keep it running and your progress safe, but we can't promise it will always be available or free of errors, or that progress will never be lost or reset. As far as the law allows, the organizers aren't liable for any loss or damage from using the game.

Changes. We may update these terms. The date at the top changes when we do, and playing after that means you accept the new version.

Fair play

Every hero should reach the top the same way: by knowing their stuff. So:

• Answer your own questions. Talking cyber-security with friends and teammates is the whole point, but don't share or use lists of answers.
• One hero per person. Don't use spare heroes to try answers out for your main one.
• Play the game, not the API. No bots, scripts or tools that answer, open terminals or send requests to the server for you.
• Report bugs, don't farm them.

How it's checked. The server looks for patterns a person playing the game can't produce: right answers that arrive faster than anyone could read the question, a pace of right answers nobody keeps up without an answer list, answers to terminals that were never opened, answers sent faster than the game ever sends them, and one browser where a hero misses an answer and another then gets it right first time, again and again. The checks are automatic and the same for everyone. They only raise a flag: an organizer looks at the evidence before anything happens.

What can happen. A hero who breaks these rules can be put in cyber jail for a while (nothing they answer counts until they're out, and their hero stands in a cell at Hero HQ, where everyone can see it and throw things at it), have their progress reset, be removed, or be left out of prizes. If you think we got it wrong, email [email protected].

Privacy notice

The short version. The game doesn't ask for your email, your real name or a password, sets no cookies and shows no ads. It doesn't sell your data, or share it with anyone but the services that run the game (below). It keeps the hero name you choose and your progress, to run the game and its leaderboards and to keep it fair and secure.

What the game stores

In its database (and its backups):

• your hero name, which you choose and which is public on the leaderboards,
• a random ID for your hero, and a scrambled (hashed) form of your Hero Code to recognize it: never the code itself,
• when you joined, and your progress: for each challenge, whether and when you solved it, wrong answers, hints taken and points,
• your team, if you're on one, and what you spent and patched in the Vulnerability Arena,
• fair play records, from the first answer that matches one of the checks above: which check, how often, when, and a few examples (which challenges, how many seconds an answer took, and which other hero played in the same browser),
• bug reports you send: what you wrote, the challenge it's about, and details that help fix it: the game version, your browser (as it describes itself), screen size, graphics setting, whether it's a touch screen, whether multiplayer was connected, and where you were in the game,
• each week's final board: the ten heroes with the most points when the week ended, with their points and challenges solved, to name the week's champion,
• if the organizers put your hero in cyber jail: until when, the reason they gave, and how many times other heroes threw something at it.

Only in the server's memory, forgotten within hours, and not written to disk or (in normal running) to logs:

• your IP address, for rate limits (gone 10 minutes after your last request),
• which terminals you opened and when, to time answers for the fair play checks,
• a random ID your browser makes up for the game, so the checks can notice several heroes taking turns in one browser,
• in multiplayer, your position and emotes, passed on to the heroes on your island.

The server's own log, which keeps only its latest entries, notes moderators' actions and fair play flags, with hero names.

Saved on your device, in your browser's storage for the site: your Hero Code, settings, builds, last position, which tips you've seen, and the random browser ID above. Clearing your browser's data for the site removes them, so save your Hero Code first.

Who sees what

• Everyone: hero names, levels, scores and team names on the leaderboards, each week's champion and their points on the title screen, the top patchers in the arena, and heroes in cyber jail, with how long they have left and how often they've been hit (never why). In multiplayer, heroes on your island see your hero name, level, team and where you are (switch Multiplayer off in the menu to stay hidden), and your teammates see whether you're online.
• The organizers, on the game's admin page: what the game stores about each hero, listed above, including fair play records and bug reports, and which other heroes played in the same browser as a hero in the last few hours. They can put one hero's numbers on a big screen (their totals, share of right answers and completed quests). They can't see your Hero Code, which is only stored scrambled, or your IP address.
• The companies the game runs on. Its server is at Oracle Cloud. Cloudflare sits in front of it to protect it from attacks: it sees your IP address and your requests to the game, including the Hero Code that travels with them, under Cloudflare's privacy policy. Cloudflare can set a cookie of its own when it needs to check whether a visitor is a bot, and asks some browsers to report failed connections to it. When the robot check on signing up and signing in is on, it's Cloudflare Turnstile, which looks at your browser to tell people from bots (Turnstile privacy addendum).

That's all: no analytics, no ad networks, no trackers.

Why, and for how long

Only to run the game: show the leaderboards, keep your progress, keep it secure and fair, and fix bugs. We keep the game's data for the event, and delete it, backups included, within 30 days after Cyber Hero Month ends. A hero the organizers remove is deleted at once, with their fair play records and bug reports, and their name disappears from other heroes' records and from the weeks' boards. Backups made before that still hold them until those are deleted too: the server deletes its own after 14 days, and the copies kept elsewhere go after the event.

Your choices

To have your hero renamed or deleted, or to ask what the game holds about you, email [email protected] with your hero name. Never send your Hero Code: we'll make sure the hero is yours another way.

Children. The game doesn't ask anyone's age or real name. If a child has used their real name, email us and we'll rename or remove the hero.

Changes. If this notice changes, the date at the top changes too.

Security

Found a security problem in cyberhero.lol? Please tell us: email [email protected] with what you found and how to reproduce it. (It's in our security.txt too.)

While you look: only use your own heroes, don't access other players' data or Hero Codes, don't disrupt the game for others (no floods, denial of service or automated scanning), and give us time to fix the problem before you tell anyone else. Reporting it is exactly what a cyber hero does: thank you.

Credits

The game's code, world, characters, challenges, music, sounds and pictures were made for it. It's built with:

• three.js, under the MIT License,
• the fonts Press Start 2P, Chakra Petch and Share Tech Mono, under the SIL Open Font License 1.1 (Press Start 2P, Chakra Petch, Share Tech Mono),
• on the server: Node.js, PostgreSQL, nginx, ws (MIT License) and postgres (Unlicense).

CVE is a registered trademark of The MITRE Corporation. Other product and company names are trademarks of their owners.

Contact

[email protected]: for questions about these terms or your data, fair play decisions, bugs (or use Report a bug in the game's menu) and security problems.