Cookies and local storage
AppSec Arena uses only what is needed to sign you in and to remember your lab progress. There are no analytics, advertising or third-party tracking cookies, so there is nothing to opt into.
Cookies
Set by the AppSec Arena API when you sign in. Strictly necessary.
| Name | Purpose | Lifetime |
|---|---|---|
| access_token | Short-lived sign-in session (HttpOnly, not readable by scripts). | 15 minutes |
| refresh_token | Renews the sign-in session (HttpOnly, sent only to the auth endpoint). | 7 days |
| csrf_token | Protects state-changing requests against cross-site request forgery. | 7 days |
Local storage
Stored only in this browser and never sent to our servers. Clearing your browser data removes it, including lab progress.
| Name | Purpose |
|---|---|
| lab-challenge:*, lab-arcade:*, hex-quiz:*, room-complete:* | Your lab checklist progress: pre-flight, drills, verification and objective. |
| academy:days | Days you were active, used for your streak and activity grid. |
| castor:educator, castor-seen:* | Whether Castor opens the briefing automatically, and which labs you have opened. |
| Lab state (e.g. api-playground history, simulator state) | Resumes an individual lab where you left off. |
| theme, ui-density, panel widths | Display preferences. |
| cookie-notice-ack | Remembers that you dismissed the storage notice. |