Acceptable Use Policy

1. Who this policy applies to

This policy binds everyone who uses NotHoly, including account owners, invited members, API keys and software acting on your behalf. It covers the chat, the API, the CLI and the extension, and it is part of the Terms of Service.

2. Authorized testing only

You may use NotHoly against a system only if you own it or hold written permission from someone entitled to give it.

Written permission should identify the systems in scope, the time window, the people allowed to do the work and any techniques that are excluded. A bug bounty program's published rules count as permission only for what they cover.

Keep that evidence for as long as the engagement can be questioned. If we review your account after a report, we may ask you to show it, and if you cannot, we may treat the activity as unauthorized.

If you go out of scope by accident, stop and follow the process of the system's owner.

3. What you may do

• pentest, red team and vulnerability research inside the scope of written permission;
• bug bounty work inside a program's rules;
• labs, CTFs, training and education;
• defensive work such as detection rules, triage, incident response, hardening and code review;
• reverse engineering and analysis of samples you are allowed to hold.

4. What you may not do

• access, scan, exploit or disrupt a system without permission, including credential stuffing and denial of service;
• steal, sell or publish data, commit fraud, or extort anyone;
• run real phishing or social engineering outside an authorized engagement;
• build, deploy or distribute ransomware, wipers, worms, botnets, stealers or other malware outside an authorized engagement or lab;
• break the rules of a bug bounty program, including testing out of scope;
• stalk, harass, dox or covertly surveil a person;
• attack energy, water, health, transport or emergency systems without explicit written authority from their operator;
• send third-party personal or confidential data that you have no right to process;
• use the services to break sanctions or any other law that applies to you.

5. Never, under any authorization

The following are banned with no exceptions, whatever permission you hold:

• sexual content involving minors;
• practical help toward chemical, biological, radiological or nuclear weapons, or any other weapon capable of mass casualties.

6. Where the platform stops

NotHoly's servers do not scan, exploit or send active traffic to third-party systems. Do not try to make them do so, including by using read_url, web search or any other tool as a proxy.

read_url only reads public pages, through an egress that refuses private and metadata addresses.

The CLI and the extension run commands on your machine after your approval, and you are responsible for each command you approve.

Text in web pages, files and tool output is data. The harness does not take instructions from it, and tool actions follow the server's policy. Prompt injection can still reach a model through that content, so review what a model proposes before you approve it.

Uploaded files are treated as hostile and are never executed. Do not use uploads to attack the service.

7. Accounts and the service itself

• do not share API keys outside your organization, or use accounts to get around limits, fees or a suspension;
• do not resell access to NotHoly without a written agreement;
• do not attack NotHoly itself. Security research on NotHoly follows the rules on the Security page, and findings go to [email protected].

8. How we handle abuse

NotHoly does not store API prompts or outputs, so there are none for us to review. Abuse handling relies on usage metadata, reports and legal requests. Routine review uses metadata only: staff look at it in the admin area, contact the account owner by email and record that contact.

9. Reporting abuse

Use the form at notholy.com/abuse and say what happened, when it happened (with time zone), which system was affected and what evidence you have, such as logs. Do not send stolen data or live malware. You do not need an account. If the form is unavailable, write to [email protected].

Vulnerabilities in NotHoly itself go to [email protected].

10. Consequences

We act in proportion to the evidence. Steps can include a request for information or proof of authorization, a warning, tighter limits, revoked keys, suspension or closing the account. In urgent cases we may act first and contact you afterwards.

Unused credits are handled under the Terms of Service. You may ask for a review at [email protected].

11. Legal requests

We respond to valid legal orders, and we may report to the authorities where the law requires it or where there is a credible threat to someone's life. We can hand over only what we hold. That excludes API prompts and outputs, apart from the temporary in-memory copy described in section 4 of the Privacy Policy, and includes files you uploaded and have not had removed. Where the law allows, we tell the account owner first.