Sandbox Data & Usage Policy
Last updated: 2026-07-30
This page explains specifically what happens when you launch a CTF sandbox terminal — separate from the general privacy policy, since the sandbox works differently from the rest of the site and deserves its own plain explanation.
What we log
- Session metadata only: your account, which challenge (if any) the sandbox was launched for, and the start/expiry time.
- We do not log terminal keystrokes or session content. The terminal is a direct pass-through to your container — we don't record what you type or what appears on screen.
Network access — the important part
The practice sandbox has real internet access so tools like nmap,
whois, and sqlmap actually work against live targets. That
traffic leaves from this server's IP address, not yours — anything
you scan or connect to will see SecurityGab's infrastructure as the source, not your
own connection. Use it accordingly: don't target anything you're not authorized to
test. See the ground rules — the same "no DoS, no mass
scanning, no touching other users' data" rules apply here.
Isolation
Each sandbox session runs in its own container, unable to reach any other session directly (inter-container communication is disabled on the sandbox network). Sessions are resource-limited (CPU/memory) and automatically destroyed after 30 minutes, or sooner if you end the session yourself.
What survives after a session ends
Nothing, by design. The container's filesystem is read-only except for a small scratch area that's wiped when the container is destroyed — anything you create inside the sandbox (files, downloaded tools, command history) does not persist between sessions. The session metadata row itself is deleted from our database at the same time.