Acceptable Use Policy

Effective September 29, 2026

This Acceptable Use Policy ("AUP") governs your use of devencelab.com, the services we make available through it, and any research, tooling, documentation, or material we publish (together, the "Services"). It forms part of our Terms of Use, and the definitions in those Terms apply here.

We publish research on AI security, agentic systems, and the assurance of autonomous software. Some of that material describes attack techniques, failure modes, and the limits of defensive controls, because a defence cannot be evaluated without describing what it is defending against. That material is published to help people defend systems. Using it to attack systems you are not authorised to test is a breach of this policy and, in most jurisdictions, a crime.

1. General prohibitions

You must not use the Services:

• in breach of any applicable law or regulation, including computer misuse, data protection, export control, and sanctions law;
• to infringe any intellectual property, privacy, publicity, or other right;
• to defame, harass, threaten, stalk, or intimidate any person;
• to publish or transmit material that is unlawful, or that sexually exploits or endangers a minor;
• to misrepresent your identity, affiliation, or authorisation, or to impersonate any person or organisation; or
• to interfere with any other person's use of the Services.

2. Security and integrity of systems

You must not use the Services, or any material obtained from them, to:

• gain or attempt to gain unauthorised access to any system, network, account, or data, whether ours or a third party's;
• scan, probe, or test the vulnerability of any system or network without the documented authorisation of its owner. Testing against our own systems is permitted only within our Responsible Disclosure Policy;
• circumvent or defeat any authentication, authorisation, rate limit, sandbox, isolation boundary, quota, or other technical control;
• develop, distribute, or deploy malicious code — including malware, ransomware, spyware, rootkits, keyloggers, cryptominers, botnet clients, droppers, or loaders;
• steal, harvest, or traffic in credentials, tokens, session material, API keys, or other authentication secrets, including by phishing or credential stuffing;
• conduct phishing, pretexting, or social engineering against any person;
• carry out a denial-of-service attack of any kind, or otherwise degrade the availability of any system;
• establish persistence on any system you do not own, or install any means of maintaining access;
• evade detection, tamper with logs, destroy forensic evidence, or defeat monitoring on a system you are not authorised to administer; or
• use our systems as a staging point, relay, or proxy for activity directed at a third party.

3. Automated access and data extraction

Our research is published to be read, indexed, and cited, and we publish machine-readable representations of it expressly so that automated clients can read it efficiently. Section 3 of our Terms of Use sets out the conditions.

You must not:

• access the Services at a rate that degrades them for others, or ignore a rate limit or a 429 or 503 response;
• use a deceptive user-agent string, or impersonate a known search engine or research crawler;
• disregard the directives in our robots.txt;
• systematically extract or re-utilise a substantial part of the Site in a way that conflicts with our normal exploitation of it, or that reconstitutes a substantial part of it elsewhere;
• harvest Personal Data from the Services, including names, email addresses, or professional details, whether for marketing, enrichment, resale, or any other purpose; or
• use the Services, in whole or in substantial part, to train, fine-tune, or evaluate a machine learning model, or to construct a dataset for that purpose, except as permitted by a mandatory text and data mining exception in applicable law.

4. AI-specific prohibitions

Where we make any AI-assisted feature available — including an assistant on the Site — you must not use it to:

• generate malware, exploit code, or attack tooling intended for unauthorised use;
• plan, script, or automate an attack on any system you are not authorised to test;
• generate phishing content, fraudulent communications, or material designed to deceive a person into disclosing credentials or making a payment;
• produce disinformation, synthetic media of a real person presented as genuine, or content designed to manipulate an election or a market;
• generate content that sexualises minors, incites violence, or promotes self-harm;
• attempt to extract the system prompt, training data, credentials, or configuration of the assistant or any system behind it;
• attempt to induce the assistant to breach this policy, whether by prompt injection, jailbreaking, or any other means; or
• build an autonomous agent that takes consequential real-world action — financial, legal, medical, or operational — on the basis of its output without competent human review.

Output from any AI-assisted feature is subject to our Research Disclaimer. It may be wrong, and it must be independently verified before operational use.

5. Content you submit

You must not submit to us, through any form, endpoint, or channel:

• malicious code, or a file whose actual content differs from what its name or declared type indicates;
• content you have no right to send, including another person's Personal Data without a lawful basis;
• special categories of Personal Data, as described in Section 3.4 of our Privacy Policy;
• confidential information, absent a signed agreement with us — see Section 4.2 of our Terms of Use; or
• unsolicited commercial communication, bulk submissions, or automated form traffic.

6. Research exception

Nothing in this policy prohibits:

• security research conducted against your own systems, or systems you are documented as authorised to test;
• good-faith research against our systems within our Responsible Disclosure Policy;
• academic study, teaching, journalism, criticism, or review; or
• any act permitted by a mandatory provision of applicable law.

The distinction this policy draws is authorisation, not subject matter. We publish offensive technique because defenders need it. Read it, teach it, build defences against it. Do not point it at a system whose owner has not asked you to.

7. Reporting abuse

Report a breach of this policy to abuse@devencelab.com. Report a security vulnerability to security@devencelab.com under our Responsible Disclosure Policy instead — that is not an abuse report, and it is welcome.

8. Enforcement

We may, at our discretion and without notice:

• rate-limit, block, or permanently deny access from an address, network, or client;
• remove or disable access to material submitted in breach of this policy;
• suspend or terminate your access to the Services under Section 12 of our Terms of Use;
• preserve and disclose records where we believe in good faith that disclosure is necessary to investigate a breach, comply with a legal obligation, or protect the rights, property, or safety of any person; and
• report conduct we believe to be criminal to the competent authorities.

We will apply the least restrictive measure that addresses the problem. Where a breach appears to be an honest mistake and no harm has occurred, we would rather tell you than block you.

9. Changes

We may update this policy as the risks change. The effective date above records when the current version took effect. Material changes will be given prominent notice on the Site.

10. Contact