New version of the Lab terms from 1 December 2026
This page shows the wording of the clauses that change on 1 December 2026. Until then, the version under “Lab Terms” applies. On 1 December you will be asked expressly for your agreement the next time you start a VM; without it, no further Lab use is possible. If you do not agree, you can delete your account at any time in the settings.
§ 1 (1) (replaces the current paragraph)
(1) The Lab platform is a free learning offering for practical IT security. It focuses on defensive topics such as system hardening and secure configuration. To help learners understand the attacker's side, individual modules also cover offensive techniques in isolated practice environments (§ 5). The offering is aimed mainly at pupils, apprentices and self-learners.
§ 4 (3), last sentence (replaces the current last sentence of the paragraph)
The provider may adjust thresholds and capacity limits to protect the platform and to ensure even availability. If a change impairs the usability of the Lab more than insignificantly, the provider announces it in advance by e-mail. The learner may then end the free usage relationship at any time by deleting their account.
§ 5 Learning content, offensive exercises and criminal law (replaces the current § 5 in full)
(1) Individual modules teach offensive techniques, for example finding open services or testing weak passwords. For this purpose the provider makes common, freely available security and analysis tools available (e.g. port scanners and password testing tools). Such tools can be used both to protect and to attack systems ("dual use"). The provider makes them available for training purposes only. They may only be used against the practice targets the provider designates for this purpose: within your own Lab VM or in an isolated practice environment provided by the provider. Each module states its learning objective and practice target in its description.
(2) Outside these practice targets, the learner uses the tools and what has been learned only on their own systems or with the prior express permission of the authorized person in text form. Anyone who intrudes into other people's systems without permission, intercepts or alters data or disrupts systems may commit a criminal offence under sections 202a, 202b, 202c, 303a and 303b of the German Criminal Code (StGB). The provider does not support or approve of this.
(3) Attacks on the Lab platform itself, on other learners or on third parties are prohibited under § 4 (2). In the event of a violation the provider ends the session and may block the account under § 8. If there are indications of a criminal offence, the provider may inform the law enforcement authorities.
(4) Modules with offensive content are only available from the age of 16. The year of birth given at registration is decisive. For school accounts, the rules of the school license apply.
§ 11 (2) (replaces the current paragraph)
(2) The provider announces material changes by e-mail at least 14 days before they take effect. They are not deemed accepted by silence or mere continued use. The next time a Lab VM is started after they take effect, the provider expressly asks the learner to agree to the amended version; without agreement, no further Lab use is possible. For learners under 16, the stored e-mail address of the parent or guardian also receives the announcement.
Abuse policy: new row in the consequences table
Use of practice tools against targets other than the designated practice targets: immediate VM kill and account block; report to the authorities possible if there are indications of a criminal offence.