The deal#
We operate SQL Heist as a free, educational game about how SQL injection works and how to defend against it. By using it, you agree to these terms. If you don't, don't use it.
Acceptable use#
The techniques here are taught for defensive understanding. You agree to use them only against systems you own or have explicit, documented permission to test. Attacking systems without authorisation is illegal in most places, and you alone are responsible for what you do with what you learn.
Don't try to abuse, overload, or reverse the game itself to reach anything other than the practice content it ships with.
Accounts#
An account is optional. You may use email/password or choose Google or GitHub sign-in. Provide an email you control, choose a permitted username, protect your credentials and linked provider accounts, and tell us promptly if you suspect unauthorised access. Supabase may automatically link sign-in identities that use the same verified email. You are responsible for activity under your session unless applicable law says otherwise.
You may export your account data and request deletion from account settings. A request requires recent verification with your password or a linked provider, then hides and locks the account immediately; permanent deletion is completed manually within 30 days. Our Privacy notice explains the related data processing.
Public participation#
Public profiles and the casual leaderboard are opt-in. If you join, the public fields described in the Privacy notice can be seen by anyone until you opt out. Do not use a username or display name to impersonate, harass, or publish unlawful content.
Leaderboard progress is submitted by browser clients and can be inaccurate or manipulated. It is for informal learning only: no prize, employment decision, security certification, or verified competitive result depends on it.
Availability and enforcement#
We may change, pause, or discontinue features, and may restrict an account when reasonably necessary for security, abuse prevention, legal compliance, or protection of other users. We will not use this clause to remove rights that applicable law makes mandatory.
No warranty#
The game and its content are provided “as is,” without warranties of any kind. It's a teaching tool, not professional security advice, and we don't promise it is error-free or fit for any particular purpose. Real systems are more complicated than a practice target.
Limitation of liability#
To the fullest extent allowed by law, we are not liable for damages arising from your use of the game or the skills it teaches.
Content#
The game's writing, characters, art, and code are owned by the operator unless noted otherwise. SQL is SQL — the language and the concepts belong to everyone. Don't repackage the game as your own.
The “Cowled” mark is by Lorc (https://game-icons.net/1x1/lorc/cowled.html), used under CC BY 3.0 (https://creativecommons.org/licenses/by/3.0/); SQL Heist changes its colour and size.
Changes#
We may update these terms; when we do, we'll revise the date above. Continuing to play after a change means you accept it. Questions? Reach the crew.