About Insecurity

Insecurity is a family of deliberately vulnerable applications for penetration-testing practice, made and run by Leelsey under the name Insecurity Computer Club.

What it is for is on the front page: realistic practice across the range of systems that are actually deployed. This page is about how that is organised, and about the mark every project under the name carries.

The project

How the family is organised

Ordered by attack surface, in three bands. Low, medium and high. Each band models more than the one before it, so a product further along can go wrong in ways the earlier ones cannot.
Named in full, marked in short. Every product carries the Insecurity name in full — Insecurity BBS, Insecurity Food — and a short form, IX, used as its mark: IX BBS, IX Food. The letters are the ones on the shield.
An address before a host. Each product answers to its own name under insecurity.cc, because the applications are written expecting it and do not behave the same on localhost.
The same three documents in every product repository. A work sheet with the targets and no payloads, an answer key with every payload worked, and a remediation document that walks the diffs against hardened counterparts.
Open code, one name. The code is MIT: fork it, host it, build on it. The name and the mark stay with the project — see the licence below.

The whole family, banded by surface

The mark

A glitched shield carrying the letters IX

Colour channels split, three rows torn loose, one block dropped. Shared by every project under the Insecurity name — one set of files, held in this site’s repository; the projects keep copies and refresh them from there rather than editing in place.

Two sources

The size rule

Below 64 px the full mark silts up, so there are two masters and each size is rendered from one of them.

File	Rendered at
`insecurity-mark.svg`	128 px and up — full detail
`insecurity-mark-small.svg`	64 px and down — one split, one tear

128 — full source

Variants

Four cuts of the same mark

insecurity-mark.svg primary, amber on slate
insecurity-mark-small.svg simplified master
insecurity-mark-inverse.svg for dark or busy backgrounds
insecurity-glyph.svg tileless, inherits currentColor

The glyph takes its colour from the text around it — switch the theme and it follows. It is the one mark on this page that is not an <img>: an image cannot be handed a currentColor, so the file is used as a CSS mask over the text colour instead. That keeps one copy of the artwork rather than a second one pasted into the markup. There is no channel split in mono; a single colour cannot carry one.

Palette

Four values, two roles

Slate#1e3a4ftile, seams
Amber#e8b455shield
Cyan#3f9fb8displaced channel, left
Red#c8543fdisplaced channel, right

Cyan and red are fringes, not accents. They exist on the mark and nowhere else — not in buttons, not in links, not in state colours. This site follows that rule: the four values above appear on this page as swatches, and in no other role.

Amber on slate holds contrast on light and dark backgrounds, which is why one file covers both themes rather than two.

Using it

In a page

<link rel="icon" type="image/svg+xml" href="favicon.svg">
<link rel="icon" sizes="any" href="favicon.ico">
<link rel="apple-touch-icon" href="apple-touch-icon.png">

Clear space. Keep the tile's corner radius of it on every side.
Ids are prefixed insecurity. Rename them if you inline a file twice in one document, or the second copy will reach the first one's definitions.
Do not fork the mark per project. A project that needs to stand apart should do so in its own interface, not by re-cutting or re-tinting the icon.
Do not strip the attribution. It lives in the SVG <metadata> and the PNG tEXt chunks, is invisible in the image, and is part of the copyright notice the licence requires you to keep.

Licence

What MIT covers here, and what it does not

The licence covers the files, and it is permissive on purpose: fork it, self-host it, modify it, build on it, contribute back — none of that needs asking first. It does not extend to the Insecurity name or mark, which stay with their owner regardless of what you do with the code. Call your fork whatever you like; just not Insecurity, and without the shield. See TRADEMARK.md for the rest.