You may
- Attack apps you own, including their previews and staging deploys.
- Attack apps whose owner authorized you in writing, for example a client of your agency.
- Share reports, trust pages and badges with your team, your clients and your customers.
- Use the MCP server and the CI check to fix and retest your apps automatically.
You may not
- Add an app you don't control or aren't authorized to test, or get around the ownership check.
- Use a finding to read, download, change or delete data beyond what is needed to confirm the issue and its fix.
- Use a leaked key Keybrum found for anything other than rotating it.
- Use Keybrum's throwaway accounts or test email addresses for anything else.
- Try to overload Keybrum or the apps it tests, or to use it as a proxy against other targets.
- Try to access another workspace's apps, findings or data.
- Resell attacks to third parties without the authorization of the app's owner.
If something goes wrong
If Keybrum shows you data that isn't yours, or you think an app was tested without permission, stop and write to [email protected]. We pause attacks while we look into abuse reports, and close accounts that break these rules. Serious cases may be reported to the authorities.
These rules are part of the terms of service.