Acceptable Use Policy

This policy is part of the Terms of Service and applies to everyone on your workspace. It says what you can point the crew at and what you can't.

Run quibbit against sites you own or have written permission to test, including permission from the hosting provider. Agents submit forms, create accounts, and place orders, so a site you don't control isn't yours to test. The first time you run on a domain you haven't verified, quibbit asks you to confirm you own it or have permission to test it, and keeps a record of your answer.

A pen test runs only on a domain you have verified, after an Admin or a member they allow approves it, and after you accept the pen-test terms for that domain. It stays on the domains you verified.

Pen tests probe auth, injection, and access control. They never flood a site with requests, guess passwords, or scan ports. Production is off by default.

Safe mode, rate limits, and the ownership checks stay on. Don't use quibbit to get past bot protection, rate limits, or intrusion detection on a site you don't control.

Some kinds of sites can't be tested with quibbit even with permission. This section lists them.

Share an account, resell quibbit, reverse engineer the app, build a competing product from it, collect personal data at scale, or use it for anything illegal.

If you own a site and want the crew to stop, write to [security contact email]. We confirm you own the site, then block the domain.

We can suspend or close your account, and you're responsible for claims that come from testing a site you weren't allowed to test.

Seen quibbit used against a site it shouldn't be? Write to [security contact email]. quibbit is run by [legal entity name].