Use rules · version
Acceptable use policy
Date: . Operator: PatchFirst (operator details will be published before payments open). Abuse reports and suspension inquiries: [email protected]. This policy is a separate part of the terms of service and applies to the website, API, agent and resulting data.
1. Ownership or the owner's permission
Check and connect only servers you own or are authorized to assess. Before running the agent, obtain the owner's permission to collect, process and submit information. A public address or the technical ability to access a system does not grant permission.
Stay within the agreed scope. If permission expires or is withdrawn, stop collecting data and disable the agent.
2. Prohibited activities
- Reconnaissance of other people's systems: collecting their stack, selecting targets, profiling or preparing attacks using PatchFirst, its agent or reports.
- Guessing passwords, tokens, report keys or identifiers; attempting to obtain another person's data or account access.
- Bypassing quotas, rate limits or suspensions, including through multiple accounts, addresses or automated requests.
- Excessive load, denial of service, bulk junk submissions or interference with PatchFirst or its data sources.
- Using the service, agent or data to exploit vulnerabilities, gain unauthorized access, distribute malicious code or conceal these activities.
- Reselling access, checks, monitoring or resulting data without a separate written agreement with the operator.
- Inflating invitation bonuses through your own accounts, including registering and paying through your own invitation links.
3. Accounts, agents and submissions
Do not share access with unauthorized people or submit someone else's inventory without permission. Do not include passwords, personal data, file contents or other secrets in inventory fields. Review the anonymized output before submission. You are responsible for automation running with your tokens.
4. Restrictions and suspension
For a breach, the operator may stop requests, revoke tokens, restrict or suspend an account without prior notice where needed to protect the service or others. A breach may result in suspension without a refund to the extent permitted by law. Mandatory refund rights and other remedies remain available.
The operator may request technical evidence of permission to assess a server without your name or identity documents. Do not send personal data, secrets or full inventories. If you believe a suspension is mistaken, contact [email protected] with the account identifier, event time and a short explanation; the operator will review the decision using available information.
For abuse of the invitation program, the operator may cancel bonuses obtained through the breach.
5. Reporting a vulnerability
If you find a vulnerability in PatchFirst itself, stop activity that could damage data or availability and report it to [email protected]. Do not extract other people's data as proof, publish secrets or perform load testing without separate permission.
6. Policy updates
Revisions carry a new date and version under the terms of service. Data processing is explained on the Data & privacy page.