Acceptable Use Policy
Last Updated: November 1, 2026
Strict Rule Enforcement
falheim provides powerful autonomous testing capabilities. To ensure these tools are used ethically and lawfully, all users must strictly abide by the rules outlined below. Violations result in permanent suspension.
1. The Principle of Authorized Ownership
falheim is designed exclusively for software developers, QA engineers, and engineering organizations to validate, test, and improve software they own, operate, or have been directly contracted to evaluate.
Rule of Thumb:
If you do not have direct administrative rights, written contractual permission, or explicit authorization from the system owner, you must not initiate falheim test runs against that system.
2. Prohibited Activities
The following behaviors are strictly prohibited across all falheim infrastructure, MCP endpoints, and runner containers:
A. Unauthorized Vulnerability Probing & Attacking
Executing penetration testing, exploitation payloads, vulnerability scanning, or automated probing against third-party SaaS products, competitors, public websites, or systems without owner consent.
B. Denial of Service (DoS) & Volumetric Flooding
Using falheim's headless worker pool or API fuzzers to flood endpoints with packet volumes intended to impair service availability, trigger billing surges, or exhaust target cloud budgets.
C. Infrastructure Escape & Internal Probing
Attempting to escape container sandbox boundaries, probing cloud metadata services (e.g. http://169.254.169.254), or attempting lateral network traversal within falheim's VPC.
D. Critical Infrastructure & Sensitive Targets
Directing testing workflows against nuclear facilities, life-support healthcare systems, air traffic control, emergency services (e.g. 911 dispatch), or sovereign defense networks.
E. Malicious Content Distribution
Injecting malware, trojans, cryptominers, phishing pages, or unlawful materials into target forms or databases via falheim synthetic browser actions.
3. Automated Safeguards & SSRF Protection
To enforce acceptable use, falheim incorporates automated network filtering on all outbound test requests:
- DNS Pinning & Re-binding Defense: Target domains are resolved and validated before connection to avoid DNS rebinding attacks;
- Loopback & Metadata Block: Outbound requests to
127.0.0.0/8,169.254.0.0/16, and private RFC1918 subnets are blocked by default unless routed through verified internal connector tunnels; - Rate Ceiling: Automated tests have enforced request-per-second (RPS) limits to prevent accidental denial of service against staging targets.
4. Monitoring, Investigations & Penalties
falheim reserves the right to investigate suspected violations of this Acceptable Use Policy. When an abuse notification or policy violation is detected:
- Active test runs targeting the affected endpoint will be immediately halted;
- The issuing API credentials will be permanently revoked;
- In cases of intentional malicious attacks or illicit intrusion, falheim will preserve relevant connection logs and report the incident to legal authorities.
5. Reporting Abuse
If you believe an entity is using falheim to conduct unauthorized testing or attacks against your infrastructure, please submit an urgent report to: