Acceptable Use Policy

01Authorization is required

You may only scan websites, repositories, and systems that you own or that you have explicit, current authorization to test. Authorization from a client must cover the specific targets you submit.

Standard scans are submitted through the paid API/MCP, while Deep scans use the Pro/Max project workflow. Both active modes require LaunchLock’s target ownership verification and explicit consent before they run.

02Prohibited uses

You must not use LaunchLock to:

• Scan or probe systems without authorization, including competitors’ production systems.
• Perform brute-force attacks, credential stuffing, denial-of-service testing, or intentionally destructive testing.
• Use scan results, findings, or fix prompts to attack, extort, or harm any system or person.
• Circumvent LaunchLock’s rate limits, plan limits, verification gates, or safety controls.
• Resell or proxy scanning for third parties who lack authorization for the scanned targets.
• Probe, attack, or reverse-engineer LaunchLock’s own infrastructure, except through a coordinated disclosure to support@launchlock.dev.

03Scanner behavior and limits

Public quick scans are passive and bounded: they respect crawl budgets, timeouts, and response-size limits, and avoid destructive or authenticated actions. Rate limits apply per account and per source address. If your target uses a WAF or bot protection, coverage limitations are reported honestly rather than bypassed.

04Reporting abuse

If you believe someone used LaunchLock to scan your systems without authorization, or you found a vulnerability in LaunchLock itself, contact support@launchlock.dev. Include timestamps and source addresses where possible; we investigate all reports.

05Enforcement

We may throttle, suspend, or terminate accounts that violate this policy, revoke API keys, block targets, and, where legally required, cooperate with law enforcement.