Acceptable Use Policy
Effective date: 2026-10-17
1. Scope
This Acceptable Use Policy applies to everything Secure Stack Consulting S.R.L. runs under the keptsec name: the website at keptsec.com, the oracle API and MCP server, the private package registry, artifact and document downloads, and the GitHub App (the “Service”). It forms part of our Terms of Service.
It does not limit what you may do with our open-source forks’ code. Your rights to the code come from its open-source licence, and this policy does not change them.
You are responsible for how your team members and your software agents use the Service under your keys.
2. Oracle API and MCP server
- Rate limits and quotas. Stay within the rate limits and the free or paid quota of your plan. Do not try to get around them, for example by creating several accounts or keys, rotating IP addresses, or spreading one workload across free-tier identities.
- No scraping or bulk extraction. Do not systematically download, enumerate or copy the oracle’s verdicts or our evidence corpus, by API or otherwise, beyond what your own development work needs.
- No reselling. Do not resell, sublicense, or redistribute oracle responses, or offer them as part of a competing API, dataset or service. You may use answers inside your own software and workflows, and cache them for your own use. Treat cached verdicts as stale after 7 days.
- Keys stay with you. Do not share API keys outside your organisation.
- Clean inputs. Send package names, versions and call names only. Do not send secrets, credentials, personal data, or content designed to manipulate or exploit our systems.
3. Private registry, artifacts and documents
- Do not share registry tokens outside your organisation or publish them.
- Do not mirror the private registry to give people outside your organisation access to paid-only deliverables.
- You may share SBOM and VEX documents with your customers, auditors and regulators as our Terms of Service allow, but do not alter them and present them as ours.
4. GitHub App
- Install the App only on repositories you control or are authorised to manage.
- Do not use the App, or crafted pull requests, to send spam or to trigger comments on other people’s repositories.
5. No attacks, no harm
Do not use the Service to:
- attack, scan, probe or exploit systems, networks or accounts you do not own or have written permission to test;
- develop, test or distribute malware, or hide malicious code in packages or pull requests;
- disrupt, overload or degrade the Service or anyone else’s, for example by denial-of-service traffic or load testing we have not agreed to;
- break into or bypass authentication, access controls or the security of the Service;
- break the law, including sanctions and export control laws, or infringe anyone’s rights.
6. Reporting security problems
If you find a vulnerability in the Service or in one of our forks, report it privately with GitHub’s “Report a vulnerability” button on the affected repository’s Security tab (our SECURITY.md explains how), or email support@keptsec.com with “SECURITY” in the subject line. Please include the affected component and version, the steps to reproduce, and the impact you expect. Do not report it in a public issue.
If you act in good faith, follow this policy, do not access or keep other people’s data beyond what is needed to show the problem, do not degrade the Service, and give us reasonable time to fix the issue before you disclose it, we will not pursue legal action against you for that research. We do not run a paid bug bounty.
You can report abuse of the Service, including leaked keys, at the same address.
7. Enforcement
If you break this policy, we may throttle requests, revoke keys or tokens, block IP addresses, uninstall or block the GitHub App for an installation, or suspend or close access. Where reasonable we will warn you first. Refunds after enforcement follow our Terms of Service.
8. Changes
We may update this policy and will post the new version at keptsec.com with a new effective date. Questions: support@keptsec.com.