Acceptable Use Policy

1. Authorization is mandatory

You may submit or scan only content, systems, URLs, domains, email, files and accounts that you own or are expressly authorized to assess. You must honor third-party rights, confidentiality duties, platform terms and testing boundaries.

2. Prohibited conduct

• Unauthorized access, surveillance, scanning, exploitation, credential theft or circumvention of security controls.
• Developing, distributing or operating phishing, malware, ransomware, spam, denial-of-service or abusive automation.
• Uploading unlawful content, secrets or personal data without a lawful basis and required notices.
• Testing PhiShark or third-party systems in a way that harms availability, integrity, confidentiality or other users.
• Misrepresenting results, evading limits, reselling without permission, reverse engineering except where mandatory law permits, or using outputs to unlawfully profile or discriminate.

3. Good-faith security research

Research directed at PhiShark must follow the Vulnerability Disclosure Policy. That policy does not authorize testing of customer data, social engineering, privacy intrusion, persistence, destructive payloads or disruption.

4. Enforcement and reporting

We may rate-limit, block, preserve evidence or suspend access proportionately when we reasonably suspect abuse, and may report unlawful conduct where required. We consider severity, intent, recurrence and mitigation. Report abuse to [email protected].