Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.cveplayground.com/llms.txt

Use this file to discover all available pages before exploring further.

CVE Playground uses Auth0 for sign in. You can sign up with email and password or with whichever social logins Auth0 has configured. There is no guest mode. Every action you take is tied to your account, which is what makes XP, streaks, and the leaderboard mean anything.

​
Signing in

The first time you open the app, you land on a sign in screen. Click sign in and Auth0 takes over. After Auth0 finishes, you come back to the app. If something went wrong during sign in (cancelled the flow, denied permissions, password reset midway through), the landing page shows a small banner with the error. Try again from there.

​
Claiming a handle

The handle is the part of your URL that other people see. If you pick dora, your public profile is at app.cveplayground.com/u/dora. Right after your first sign in, a modal asks you to claim one. It suggests three variants based on your email address. You can take one of those or type your own. The form checks availability in real time. Handles are:
  • Lowercase letters, numbers, and dashes.
  • Between three and roughly thirty characters.
  • Unique across the platform.
You cannot use the app until a handle is claimed. The reason is that every lab attempt, every leaderboard row, and every first blood is keyed to a handle, and the platform refuses to record any of that against a blank slate.
The display name (shown next to your avatar) is separate from the handle. The display name is whatever you want, changeable any time in settings. The handle is more permanent.

​
Your public profile

/u/your-handle is public. No sign in needed to view it. It shows:
  • Your handle, display name, and avatar.
  • The date you joined.
  • Badges you have earned.
  • A heatmap of your daily activity.
  • Your stats: labs completed, challenges solved, streak, questions answered.
The patch log (the chronological list of solved labs) and the badge wall are both visible to anyone with the URL. If you want it locked down, the only option today is to not share the link. Your email address is not on the public profile. Neither is anything else from Auth0 beyond what you set as display name and avatar.

​
Signing out

The sign out button lives at the bottom of the sidebar, under your handle. It logs you out of Auth0 and returns you to the landing page. If you are on a shared machine, sign out before walking away. Auth0 sessions persist across browser restarts by default.

​
Deleting your account

Settings has a danger zone tab. Account deletion is final: labs, questions, XP, streak, the public profile, all of it. The handle is freed back into the pool, so somebody else could claim it later. There is no soft delete. If you need a clean slate, deletion is how you get there.

Settings

Display name, notifications, account deletion.

Leaderboard and profile

What gets recorded against your handle.