Acceptable Use Policy

1Apps and content you may not create or publish

You may not use Pugi to create, host, publish, or distribute an app, site, logo, or other content whose purpose or effect is:

Malware or intrusion

software designed to break into, damage, or take control of systems, including ransomware, spyware, botnets and exploit kits aimed at systems you are not authorised to test.

Phishing or credential theft

collecting other people's passwords, payment details, or identity data under false pretences, including look-alike login or payment pages.

Child sexual abuse material

any sexual content involving minors. We report it to the authorities where the law requires.

Illegal goods or services

selling or arranging goods or services that are illegal where you or your users are.

Weapons or explosives

instructions for making weapons or explosives.

Hate or harassment

targeting people with hate, threats, or harassment.

Fraud or scams

deceiving people to take their money, data, or property, including fake shops, fake investment schemes and fake charities.

Stalkerware or covert surveillance

tracking or monitoring a person without their knowledge.

Infringement

content that infringes someone else's copyright, trademark, or other rights, including using another company's name or logo to pass yourself off as that company.

Some apps are allowed but need a closer look, for example apps with adult content, gambling, health, legal or financial advice, or sensitive personal data. We may ask you questions, require you to meet the laws that apply to that kind of app, or decline to build, host, or list it in our catalogue.

2Security checks and pentests

Pugi offers two kinds of checks. A passive check, such as our free website check, looks only at what any visitor's browser receives from a public site: its security headers, cookie flags and public scripts. An active check goes further: repository scans, pentests, and anything that sends attack traffic or reads non-public code.

You may run active checks only on sites, apps, domains and repositories that you own, or that their owner has authorised you in writing to test. By starting an active check you confirm that you have that right. Repository scans run only on repositories you connect yourself, and pentests run only against your own app.

You may not use Pugi to scan, attack, or test third-party systems without authorisation, to run denial-of-service or load attacks, or to use the results against anyone. Keep any findings about systems you are authorised to test confidential to you and the owner.

Testing Pugi itself is covered by our responsible disclosure page at pugi.io/security/disclosure. Reporting a vulnerability to [email protected] is welcome; it does not authorise you to test systems or data that are not yours.

3Using the service fairly

You may not:

Get around limits

bypass credit, usage, or rate limits, create several accounts to collect free credits, or share one paid account in a way your plan does not allow.

Break or overload Pugi

interfere with the service, probe it for vulnerabilities outside our disclosure rules, or send traffic designed to degrade it.

Misuse the AI models

try to bypass the safety systems of the models we route to, or extract their training data or our system prompts.

Resell access

resell or sublicense access to Pugi itself, or put Pugi behind your own service as a white label, unless we agree in writing. Selling the apps you build is fine.

Spam

send unsolicited bulk messages from apps hosted on Pugi.

Break the law

use Pugi in breach of export control or sanctions law, or of any other law that applies to you.

4AI agents acting for you

If you connect an AI agent to Pugi through our API, MCP server, CLI or plugins, this policy applies to everything the agent does with your key. You are responsible for the agent as if you had done it yourself. Keep your keys secret and revoke a key you think has leaked.

5What we do when this policy is broken

We screen briefs and catalogue entries automatically and review reports from people. If we believe an app, account or request breaks this policy, we may refuse the build, remove an app from the catalogue, unpublish an app or take its domain offline, revoke API keys, or suspend or close the account. Where the law or safety requires, we may act without notice and report to the authorities.

We will tell you what we did and why, unless the law or the safety of others prevents it. If you think we got it wrong, write to [email protected] and a person will review it.

6Reporting abuse

To report an app on *.pugi.app or in our catalogue that breaks this policy, use the report button on the catalogue page or email [email protected] with the address of the app and what is wrong. For security vulnerabilities in Pugi, email [email protected].