Acceptable Use Policy
Safety and authorization rules for every use of VibeSIEM Scan.
1. Authorized targets only
You may scan only systems you own or have current, express authorization to test. Authorization must come from someone able to grant it and must cover the exact hostname, selected subdomains, timing, methods, accounts, and source network. Public accessibility, a bug-bounty program, or a client relationship does not by itself prove that a particular scan is authorized.
2. Allowed purpose
Use the service only to improve the security of an authorized target, validate a repair, or conduct another lawful defensive assessment. You must act in good faith, minimize data access, avoid harm, and report results only to people entitled to receive them.
3. Prohibited activity
- Denial-of-service, load, stress, resource-exhaustion, or availability testing.
- Password guessing, spraying, credential stuffing, phishing, or social engineering.
- Destructive requests, data alteration or deletion, malware, persistence, lateral movement, or exfiltration.
- Bypassing runner safeguards, rate limits, scope controls, verification, or minimum-version requirements.
- Scanning through infrastructure you are not authorized to use, including open proxies or compromised systems.
- Evading attribution, WAF controls, provider complaints, or target-imposed blocks.
- Testing regulated, safety-critical, medical, public-sector, or third-party systems without written authorization and a suitable professional plan.
4. Data handling
Collect the minimum evidence needed. Do not retain, share, or upload secrets, personal data, or target content unnecessarily. If a check exposes sensitive data, stop further access, secure the evidence locally, redact it from reports, and notify the authorized owner through an approved channel.
5. Network paths
You may use your current network, your existing VPN, or an HTTP/SOCKS proxy you are authorized to use. A VPN does not create scan authorization. Do not rotate addresses to defeat controls. Stable customer-controlled egress is recommended for repeatable results.
6. Enforcement and reporting
We may block plans, revoke runners, preserve safety records, or suspend accounts when we reasonably suspect unsafe or unauthorized use. Report suspected misuse to [ABUSE_CONTACT_EMAIL]. Immediate danger should be reported to appropriate local authorities.