Acceptable Use

Effective: 11 August 2026

Required authorization

The customer must prove authority over every target and obtain required third-party, cloud-provider, hosting, employee, and data-owner permissions. Scope must identify allowed assets, exclusions, methods, windows, rate limits, accounts, data modes, and emergency contacts.

Prohibited use

• Testing any asset without verifiable written authorization.
• Malware deployment, persistence, destructive payloads, denial of service, ransomware, extortion, or data destruction unless a narrowly defined simulation is expressly approved.
• Credential theft, password spraying, phishing, social engineering, physical access, wireless testing, or lateral movement unless explicitly authorized.
• Accessing, retaining, or exfiltrating data beyond the minimum proof agreed in the Rules of Engagement.
• Targeting safety-critical, emergency, medical, election, or public infrastructure where disruption could harm people, unless specialist safeguards and written authority are in place.
• Evading law enforcement, sanctions, export controls, or regulatory obligations.

Operational controls

RedCore may refuse, pause, or terminate work where authority is uncertain, scope signals conflict, safety thresholds are reached, the emergency contact cannot be reached, or continued testing creates unacceptable risk. Customer stop requests take precedence over automation.

Reporting concerns

Report suspected misuse through the contact form. Do not include secrets or exploit payloads in the form.