Acceptable use policy

01What you may do

• Check apps you built or own, as often as your plan allows.
• Check client or employer apps when you have their written permission. Agencies: keep a record of that permission for each client app.
• Use the API, webhooks and MCP server to run checks from your own tools, CI and AI agents.
• Share your own reports, receipts, badge and proof page.
• Use the free RLS check on public repositories to learn and to protect your own work.

02What you must not do

• Submit a repository you don’t own or aren’t authorised to test, or try to get around the ownership check.
• Use anything you learn from PatchLabs to read, copy, change or delete data in an app you don’t own.
• Use the free tools, the API or the MCP server to mass-scan other people’s repositories, or to build lists of vulnerable apps.
• Get around rate limits, plan limits or spend caps, for example with many accounts or emails.
• Submit code designed to attack our lab, our worker or our fix agent: malware, instructions aimed at the agent, attempts to escape the lab, or anything meant to reach other customers’ data.
• Interfere with the service: overload it, probe it beyond our disclosure policy, or access accounts and reports that aren’t yours.
• Show a PatchLabs badge or proof page that is altered, out of date on purpose, or for an app it wasn’t issued to, or describe it as a certification.
• Resell or white-label PatchLabs without a written agreement with us.
• Break the law, including data protection and computer misuse laws, or help anyone else to.

03If you find a leak in someone else’s app

Don’t access the data. Tell the owner privately, give them reasonable time to fix it, and don’t publish details that would let others exploit it. PatchLabs will not run a full check on an app for anyone who can’t prove they control its repo.

04Opt-out for public repo owners

If you own a public repository and don’t want it included in PatchLabs research samples or free-tool results, email manraj@patchlabs.dev with the subject “Opt out” and the repo URL. We’ll confirm within two working days and delete anything we hold about it.

05What happens if this policy is broken

We may stop a check, revoke API keys, suspend or close the account, delete the related reports, and, where the law requires or the risk to others is serious, report the activity to the relevant authorities or the affected app’s owner. Where we can, we’ll explain what we saw and give you a chance to respond.

06Reporting misuse

If you think someone is using PatchLabs against your app, email manraj@patchlabs.dev with the subject “Misuse”. For security problems in PatchLabs itself, see the disclosure policy.