Acceptable Use Policy

Scope and authorisation

This policy applies to the bridgework website and, where incorporated into a written agreement, an enterprise pilot or service. Access to a repository, runner, API or account must be authorised by its owner. This policy does not itself grant service access or permission to test third-party systems.

Prohibited activities

• Illegal activity, fraud, harassment, impersonation, infringement of intellectual property or violation of privacy rights.
• Accessing repositories, credentials, accounts or systems without permission, or bypassing access controls and usage restrictions.
• Distributing malware, stealing secrets, exfiltrating data or using generated changes to compromise another system.
• Attacks, disruptive automated traffic, spam, or deliberate interference with service availability.
• Probing or exploiting vulnerabilities outside the scope of explicit written authorisation.
• Using the service to evade API-provider terms, licensing obligations or legal restrictions.

Customer responsibilities

For an authorised engagement, provide only repositories and data you have permission to use. Configure credentials and runner permissions appropriately, follow applicable third-party terms, and follow the agreed handling rules for personal data and secrets.

Set review and merge controls appropriate to your repositories, including any auto-merge rules. Generated patches and passing tests do not remove your responsibility for merge authorisation, environment configuration and release decisions.

Reports and enforcement

Report suspected misuse or a vulnerability to Reveal legal email. Provide enough detail to investigate without sending live credentials or unnecessary personal information. Please avoid accessing other users’ data or disrupting systems while making a report.

We may investigate misuse and restrict or suspend access where reasonably needed to protect systems, users or legal compliance, subject to any applicable customer agreement. This policy does not create a public bug-bounty programme or authorise security testing.