Acceptable
Use.

Authorization

Written, scoped, current authorization for every system you interact with. Your own lab, your own machines, your own models, or a CTF range all qualify. "It was in scope, trust me" does not - keep your engagement papers, because we can and will ask.

"Unrestricted" on this platform describes model behavior - the models engage with sensitive security topics instead of lecturing you. It does not describe the rules. Rate limits, metering, and this policy are the governance layer, enforced contractually.

Allowed

• +Security research on systems you own or are authorized to test, with written scope
• +Exploit reproduction and patch validation in isolated labs
• +Malware analysis and reverse engineering of samples in your possession
• +AI red-teaming: injection suites, guardrail differentials, eval-set generation
• +CTF design, training environments, and red-vs-blue exercises
• +Detection engineering: log triage, Sigma authoring, tuning and regression
• +Fiction and creative writing with realistic procedure

Prohibited

• xFacilitating crime of any kind - this platform is not a crime service
• xUnauthorized access to any system, or helping anyone gain it
• xMalware distribution, ransomware operations, or credential theft against third parties
• xChild sexual abuse material, or content sexualizing minors, without exception
• xTargeted harassment, stalking, or doxxing of real people
• xAssistance for biological, chemical, or radiological weapons
• xAttacks on critical infrastructure or industrial control systems you don't own
• xEvading bans, rate limits, or the identity checks this platform runs

Non-exhaustive. The test is simple: would the target's owner, or the law, call this authorized?

Enforcement

Violations end keys and accounts. Serious violations are reported where the law requires. We keep the evidence trail: metering records, request metadata, and audit logs exist for exactly this purpose - and no deeper than that purpose.

Reporting

Found someone abusing the platform, or found a hole in it? Both are welcome reports. Use any support channel; security-researcher-safe by default.