Acceptable use policy
Pebble Labs gives you administrative access to live virtual machines in our cloud account, reachable over a VPN tunnel into a private network. This page sets out what you may attack, what you may not, and what happens if you cross the line. It forms part of the user agreement, and everyone accepts it before the product will do anything for them. Your account page shows the day you did.
What is in scope
Every lab tells you what you may attack. Read that list before you start, and attack what is on it and nothing else.
On a lab that deploys a network, the list is the topology. The deploy builds its own isolated network in our cloud account, dedicated to you for as long as that lab runs, and the machines and subnets in it are your target. You may exploit them, escalate on them, move between them, break them, and reset them as often as you like.
Other labs put you in a service we run instead, such as a Microsoft 365 tenant. Nothing gets built for you on those and nothing gets torn down after you: other students are working in the same place at the same time, and it is still there when you stop. The lab's scope list names the tenants, domains and addresses you may attack. Attack those.
Two more rules apply in an environment you share.
- Leave it working for the next person. Do not delete what you did not create, do not lock anyone else out, and do not change a tenant-wide setting that would end everyone else's exercise.
- Leave the other students alone. Do not touch their accounts, their sessions, or anything they have left behind, even when it is easy to reach.
Nothing else on our infrastructure is in scope.
What is out of scope
Do not attack, probe, or attempt to gain access to:
- The Pebble Labs web application, its database, its authentication, or the accounts of other users.
- The VPN gateway itself, the provisioning system that builds labs, the machine image catalog, or anything in our cloud account outside your own lab network.
- Another customer's lab, and another student's account or work inside a shared environment. Deployed labs are isolated from each other, and attempting to reach one is a breach whether or not it works.
If you find a flaw in the platform itself, we want to hear about it. Report it to security@pebblelabs.org rather than exploiting it, and we will not pursue you for finding it in good faith. Continuing past proof of the flaw, taking other people's data, or degrading the service for anyone else takes it outside that protection.
Egress and the outside world
Most lab machines have no general internet access. Where a lab grants one outbound connectivity, it is limited to a few protocols, and the traffic is translated through your lab gateway, which applies its own allow-list on top. Defeating either is a breach of this policy, even from a machine you have legitimately compromised.
Some labs include an internet-facing machine, because the attack path being taught begins on the public side. That machine has a real public address, is reachable from the internet on the ports the lab exposes, and routes outward directly rather than through the gateway. Its address is shown on the lab page, so you can always tell which of your machines this applies to. The rule below applies to it all the same.
Concretely, do not use any lab machine to scan, attack, relay traffic to, or host anything for a system outside your own lab. That includes using one as a proxy, an exit node, a command-and-control host for real operations, or a staging point for a live engagement. This holds whatever the network in front of you happens to permit.
What lab machines are not for
Compute in a lab is for working the lab. Do not use it for cryptocurrency mining, distributed computing for hire, sending mail, hosting a service, or storing material unrelated to the exercise. Do not store anything on a lab machine that is illegal to possess, and do not upload personal data belonging to anyone else.
Some labs give a machine access to a hosted AI model. Use it for the lab, not for unrelated work.
Your VPN profile and your account
Your VPN profile is one permanent file, issued against a certificate authority that exists only for you. It reaches your labs and nobody else's. Treat it the way you would treat a password: do not share or publish it, a repository included. If a copy escapes, regenerate it from your account page. Regenerating is what revokes the old one, and it takes effect everywhere the old file was copied.
Your account is for you. Do not share credentials or let another person work labs under your subscription. One person, one account.
Lab content and course content
Make what you like about the labs. Stream them, record walkthroughs, publish your notes, share your screen.
Paid course content is the exception, because those lessons are the product rather than a record of solving something. Do not republish the text, video, or exercises inside a course you bought or hold a plan for, in whole or in part, whether as text, video, or a repository of scripts.
Free courses are not covered by that. Anything the catalogue marks Free, the introductory course included, you may stream, record, and write up exactly as you would a lab.
Publish flag values and task answers too. You do not have to blur them or hide them behind a spoiler warning.
Two things none of this lets you do. Do not scrape the platform or bulk-download what is on it, and do not train a model on our work. Both stay prohibited under the user agreement, wherever you got the material and whether or not you wrote it up yourself. Using an AI assistant while you work a lab is fine.
Conduct in shared spaces
Some parts of the service are shared with other people: our support email, and any community channels we run, such as Discord. In them, behave like a professional. Harassment, threats, hate speech, spam, and deliberately disrupting other people's use of a channel are not allowed, and neither is reposting the course content the section above rules out. We may remove your access to a channel, or suspend your account, for any of these.
Outside the platform
What you learn here works on systems that are not ours. Using it against a system you do not own or have written permission to test is a crime in most countries, and it is not something we can authorize. Your account with us is not authorization for anything beyond your own labs.
If you break these rules
Depending on what happened, we may suspend your labs, suspend or close your account, revoke your VPN profile, or refuse to serve you in future. For anything that damages other customers or breaks the law, we will also preserve the relevant logs and cooperate with law enforcement.
We would rather ask first. If something you want to try sits near one of these lines, write to legal@pebblelabs.org and ask.