Acceptable use

LevelUp runs vulnerable code in isolated sandboxes for training purposes. You agree not to:

• Attack or attempt to escape the sandbox boundary into LevelUp infrastructure. Container escapes are vulnerabilities — report them to security@levelupctf.com.
• Attack other players, scrape the leaderboard, or try to de-anonymise other accounts.
• Share or publish challenge flags, full writeups of active challenges, or solver scripts that trivialise future attempts. Generalised learning content (techniques, methodology) is welcome.
• Automate account creation or attempt to game the ELO / AI-classifier systems.
• Use the platform to plan or execute attacks against systems you do not own or have explicit authorisation for.

Your account

You’re responsible for keeping your credentials secure. If you suspect account compromise, use the password-reset flow or email security@levelupctf.com. We may suspend accounts that violate these terms; we’ll tell you why if we do.

Intellectual property

Challenge content, the REACTOR pipeline, and all platform code are owned by LevelUp and its licensors. Challenges are for personal use and training — redistributing them outside the platform requires written permission.

Your solve history, writeups (where you choose to publish them), and profile content remain yours. By posting content visible to other players, you grant us a non-exclusive licence to display it within the platform.

Billing and subscriptions

Paid plans (Team, Business, Enterprise) are billed monthly or annually per the plan page. Cancellation ends billing at the end of the current period; we don’t pro-rate refunds for partial months except where required by local consumer-protection law.

AI Agent Evaluation API usage is metered. Rate limits and quotas are documented on the pricing page and in API responses.

Service availability

We run LevelUp as reliably as we can but don’t promise an SLA on free or Developer tiers. Enterprise contracts include a written SLA with credits for breach.

Limitation of liability

To the maximum extent allowed by law, LevelUp is not liable for indirect, incidental, or consequential damages arising from platform use. Our aggregate liability is capped at the amount you paid us in the 12 months before the claim.

Nothing in these terms limits our liability for fraud, gross negligence, or statutory rights that cannot be waived.

Privacy

How we collect and use data is covered on the Privacy page. It’s linked from here because it’s the companion document to these terms.

Changes

We’ll email material changes to these terms at least 14 days before they take effect. Continued use of the platform after the effective date confirms you accept the updated terms.