Acceptable Use Policy · Version 1.0

Acceptable Use Policy

Effective September 7, 2026. These rules apply to ThreatWing Tools, ThreatWing Decompiler, and any related processing service.

Required behavior

• Obtain permission and stay within the approved systems, addresses, artifacts, techniques, time window, and rate limits.
• Use the narrowest target and least disruptive method that can answer the question.
• Protect credentials, keys, captures, binaries, reports, and personal or confidential information.
• Review commands and AI suggestions before execution; maintain backups and a rollback path.
• Stop when ownership, scope, identity, host keys, or impact becomes uncertain.
• Comply with applicable laws, contracts, platform rules, and coordinated-disclosure requirements.

Prohibited behavior

• Unauthorized access, surveillance, interception, credential collection, persistence, evasion, malware delivery, destructive action, or service disruption.
• Broad or unsolicited internet scanning, spam, harassment, stalking, doxxing, or targeting people based on sensitive characteristics.
• Testing third-party systems merely because they are reachable or appear vulnerable.
• Uploading or decompiling material you lack the legal right to analyze.
• Bypassing product safety prompts, subscription controls, access gates, or rate limits.
• Using output as the sole basis for a high-impact decision without qualified human review.

Security research

A bug-bounty or vulnerability-disclosure policy is authorization only to the extent of its written scope. Preserve evidence, minimize accessed data, avoid persistence, and use the program’s required reporting channel.

Enforcement

Access to a hosted service may be limited or terminated when activity presents abuse, legal, operational, or third-party risk. Where practical, evidence needed to investigate an incident is handled under the applicable privacy and retention notice.

Questions

If scope is unclear, do not run the action. Email support@threatwing.com for product questions or the system owner for authorization.