DEFENSIVE TESTING BOUNDARIES & RULES

Acceptable Use Policy

Last Updated: September 23, 2026 • Strict Defensive Cybersecurity Framework

LEGAL REVIEW RECOMMENDED: This Acceptable Use Policy establishes operational testing boundaries for defensive security scanning. Enterprise customers must review and align these rules with their internal security, data protection, and IT governance standards prior to launching production evaluations.

Shieldmix One is built exclusively to advance defensive cybersecurity, identify security vulnerabilities before adversaries do, and assist software engineering teams in hardening their systems. Use of the platform for malicious offensive operations, unauthorized testing, or disruptive attacks is strictly prohibited.

Expressly Prohibited Activities

Unauthorized Scanning of Third-Party Targets

Attempting to probe, scan, or analyze any domain, hostname, IP address, or API without explicit verified ownership or documented authorization.

Denial of Service (DoS / DDoS) & Resource Exhaustion

Transmitting voluminous network traffic, resource-exhaustive query loops, amplification vectors, or packet floods aimed at degrading target availability.

Destructive Exploitation & Data Mutation

Executing arbitrary remote code execution (RCE) payloads that alter database records, delete files, truncate tables, or corrupt production application state.

Credential Stuffing & Mass Brute Force

Conducting automated credential attacks against authentication forms, spraying leaked password databases, or attempting dictionary login storms.

Phishing, Social Engineering & Physical Tampering

Impersonating target employees, transmitting deceptive emails, conducting voice phishing, or engaging in physical facility testing.

Malware, Persistence & Lateral Movement

Planting persistent backdoors, webshells, rootkits, C2 beacons, or attempting lateral pivots across customer internal VPC infrastructure.

Mass PII / Exfiltration of Sensitive Customer Records

Extracting bulk user databases, credit card registries, proprietary cryptographic keys, or health records beyond minimal proof-of-concept indicators.

Mandatory Authorization & Enforcement

Before any scan or penetration test is initiated:

Domain ownership must be cryptographically established via DNS TXT or HTTP token verification.
Enterprise penetration testing requires mutual digital sign-off of our standardized Rules of Engagement and Testing Authorization charter.
Violations of this policy will trigger immediate suspension of all active scans, revocation of API tokens, termination of account access, and notification to applicable upstream internet service providers.