Acceptable Use Policy

You may only scan domains, IPs, APIs, or applications that (a) you own, (b) your employer owns and has authorized you to test, or (c) you have explicit, written permission from the asset owner to test. "Permission to test" must include the scope and time window you actually scan.

You may never scan:

• Government, military, or critical infrastructure systems without explicit written contract.
• Bug-bounty targets outside the program's published scope or rules of engagement.
• Third-party SaaS products you merely use (you don't own them).
• Systems where automated security testing is contractually prohibited by the asset owner.

You may not use Xalgorix to:

• Maintain access, exfiltrate data, or pivot beyond the discovery and verification needed for a finding.
• Generate denial-of-service against a target (our engine resists this; do not work around the rate limiter).
• Stalk, harass, dox, or otherwise harm a person.
• Bypass authentication for an account you don't own.
• Re-sell raw scan capacity or wrap Xalgorix in a derivative product without a partner agreement.

We enforce per-host rate limits, automatic backoff on 5xx, and a destructive-payload allowlist that defaults to off. Attempting to disable or evade these controls is a violation of this Policy.

If you believe Xalgorix is being used to attack systems you own or operate, email abuse@xalgorix.com with the target host(s), timestamps (UTC), and source IPs from your logs. We triage within 4 hours and can hard-stop the offending account.

Violations result in immediate scan termination, account suspension, forfeiture of remaining credits without refund, and — for clear cases of unauthorized access — referral to the appropriate law-enforcement authority. We cooperate with valid legal process.