Acceptable Use Policy

1. Authorization is your responsibility

You must have the right to test, scan, monitor, probe, interact with, or automate against every Target you submit. Skydra does not determine on your behalf whether you are authorized to interact with a particular Target. The scope policy inside your workspace is a technical safety control, not a legal authorization — it enforces the configuration your workspace owner declared, nothing more.

Public accessibility is not authorization. A URL being reachable from the internet, a bucket responding to anonymous reads, or a provider identifier appearing in a repository or log does not mean you have permission to test it.

2. Permitted uses

You may use the Service for the following, provided each is lawful and you have the required authorization:

• Security testing of systems you own, operate, or are contracted to test;
• Participation in a bug bounty or vulnerability disclosure program, within the scope and rules of that program;
• Asset discovery, inventory, and monitoring of infrastructure you control;
• Automated workflows, scheduled scans, and continuous testing of authorized Targets;
• Defensive security activity against your own services;
• Research, education, and development against systems you are authorized to test.

3. Prohibited uses

You must not use the Service to:

• Access systems you are not authorized to access;
• Intentionally disrupt, degrade, or damage systems or services;
• Intentionally cause denial of service or resource exhaustion;
• Bypass authentication or authorization without permission;
• Obtain, use, disclose, or exploit data you are not authorized to access;
• Conduct activities that violate applicable law;
• Violate the rules or scope of a vulnerability disclosure or bug bounty program;
• Use credentials belonging to another person without their authorization;
• Distribute malware or deploy malicious code against unauthorized Targets;
• Interfere with third-party infrastructure;
• Evade contractual, legal, or technical restrictions imposed by a Target owner;
• Facilitate fraud, theft, extortion, harassment, or other unlawful conduct.

Nothing in the Terms grants you authorization to access any third-party system.

4. Volume, rate, and concurrency

The Service runs automated, concurrent, scheduled, and distributed operations. You are responsible for configuring your workflows so that the volume and rate of activity are appropriate to the Target and compatible with your authorization.

Skydra provides per-run concurrency caps, per-workspace rate limits, action-level timeouts, and intrusive-action approvals as operational safety controls. These controls do not authorize activity on your behalf — authorization remains your responsibility.

5. Credentials you provide

Any credential, token, API key, certificate, or other authentication material you supply to Skydra must be yours or must be used with the authorization of its owner. You may not provide credentials you are not authorized to use.

You remain responsible for revoking or rotating credentials that may have been exposed or where authorization has been withdrawn.

6. Findings and responsible disclosure

Findings produced by the Service are provided for your own operational use. If a finding identifies a vulnerability in a third-party system or service, your use of that information remains subject to the applicable law, program rules, and disclosure obligations of the system owner.

Vulnerabilities you discover in Skydra itself must be reported through the designated security contact rather than publicly disclosed or exploited.

7. Enforcement

Skydra may suspend or terminate access, remove User Content, and take other actions reasonably necessary to enforce this Policy, protect the Service and its users, respond to abuse, or comply with legal obligations. The Terms of Service govern suspension, termination, and the handling of consequences.