Allowed
Anything on a target you have the rights to. In practice that is:
- Recon, scanning, exploitation, privesc, lateral movement and persistence during a pentest or red-team engagement.
- Code review, bug hunting, exploit development, reversing and malware analysis.
- Building payloads, C2, shellcode, phishing kits and tooling for an engagement.
- Incident response, forensics, detection engineering and hardening.
- CTFs, labs, coursework, bug bounties and your own projects.
- Security research and responsible disclosure.
Not allowed
- Using it against devices or software you don't have the rights to.
- Anything illegal where you or the target are located.
Your responsibility
You're responsible for scope and for what you do with the output. Before hitting a live target, make sure you have permission and a defined scope. If you're unsure, ask the owner first. The agent does not gatekeep for you.
Enforcement
We may suspend or close accounts that abuse the service, without refund of unused credits, and may cooperate with law enforcement where required. Report misuse to [email protected].