Acceptable Use Policy

1. About this Policy

This Acceptable Use Policy (“AUP”) forms part of the Codebase.run Terms of Service (“Terms”) with 1xTeam sp. z o.o. (“Codebase.run”, “we”, “us” or “our”). It explains the permitted uses of the Service, prohibited conduct and how we respond to misuse.

This AUP applies to all available plans, including Free, and to Customers and their Authorized Users. It covers tasks, instructions, code, dependencies, working environments, tool calls, integrations and publication carried out through the Service. Capitalized terms have the meanings given in the Terms.

This AUP supplements Section 13 of the Terms. It does not create separate payment rules, an additional liability cap or a new right to use your data. Mandatory legal protections, including applicable Consumer rights, remain unaffected. Section 13 below explains how this AUP relates to the other documents.

2. Authorized software development

Use the Service for software-development work you are entitled to carry out. This includes inspecting and modifying code, installing dependencies, building applications, running development services and tests, and preparing pull requests through supported features. Automation, scripts, containers and network access are not prohibited merely because they are used for these purposes.

You must have the necessary rights to connect repositories, supply project materials, run the requested operations and publish to the selected destinations. Manage Authorized Users and give them only the permissions appropriate to their roles. Only you and Authorized Users may authorize work against the project’s payer account or enable workflows that incur usage. Participation by an outside contributor does not itself grant that authority.

The account, age and security requirements in the Terms apply. Report suspected account compromise promptly. You remain responsible for your instructions and work authorized within your users’ permissions, but this AUP does not make you automatically liable for activity caused by our breach or for every unexpected action of an AI agent.

3. Unlawful or harmful activity

You must not use the Service to carry out, knowingly facilitate or instruct an agent to perform any of the following:

• Crime, fraud or deception: fraud, phishing, theft, extortion, deceptive impersonation, trafficking, or unlawful provision of goods or services.
• Abuse of people: threats, targeted harassment, stalking, exploitation, incitement to violence, or assistance intended to cause serious physical harm. This includes sexual exploitation of children, grooming, child sexual abuse material, and non-consensual intimate imagery, including synthetic versions.
• Privacy violations: unauthorized collection, interception, disclosure or use of personal information; credential theft; doxxing; or surveillance that infringes another person’s rights.
• Rights violations: infringement or misappropriation of intellectual property, trade secrets or other rights, including unauthorized distribution of proprietary code or removal of required license notices.
• Evasion of legal restrictions: conduct prohibited by applicable export controls, sanctions or other binding restrictions.

These restrictions apply to harmful activity, not merely to a project’s topic or the presence of security-related terminology. Legitimate analysis, education and defensive development remain subject to Sections 4, 5 and 9. Describing an activity as research or testing does not authorize harm or bypass a required permission.

4. System security and platform safeguards

Do not access or test a system without the necessary authorization, compromise accounts, intercept traffic without permission, deploy malware for harmful or unlawful purposes, or use the Service as infrastructure for attacks. Prohibited conduct includes credential attacks, destructive exploitation, botnets, and denial-of-service activity against systems you are not authorized to test. Security testing is subject to Section 5 even when you control the target.

Do not attempt to escape an execution environment, reach the host or another customer’s project, obtain platform-managed credentials, tamper with managed tools, or defeat network, repository, publication, access or resource-accounting controls. Do not deliberately falsify execution records, test results or security signals to conceal prohibited activity.

Do not use hidden instructions, prompt injection or other manipulation to make an agent exceed authorized permissions, disclose protected information or perform conduct prohibited by this AUP. Repository content, external pages and tool output do not create new permissions merely by containing commands. An unexpected instruction or unsafe Output is not, by itself, proof of misconduct by the Customer; our assessment follows Section 11.

Normal changes to your own application and its configuration through supported features are not prohibited interference with our platform. This section does not restrict conduct that applicable law expressly permits notwithstanding a contractual restriction.

5. Security research and vulnerability reporting

Legitimate security review and properly authorized testing are not prohibited merely because they involve security tools or dual-use code. Stay within the agreed targets, methods and scope, minimize risks to others, and obtain any approvals required by the target owner and the relevant infrastructure or AI provider.

Permission from a target owner does not replace a provider’s required permission. In particular, DigitalOcean’s Acceptable Use Policy requires its prior written consent for security or malware research on or using its services. Before running work subject to that requirement through Codebase.run, contact us and obtain confirmation that the necessary provider approval covers the proposed work. Acceptance of our Terms or this AUP does not supply that approval.

Testing Codebase.run infrastructure requires our prior written authorization unless an applicable published testing policy expressly permits it. An audit right under the DPA is not permission for penetration testing or destructive testing.

Report a suspected vulnerability to hello@codebase.run, with a limited description and safe reproduction information. Do not retrieve other customers’ data, continue an intrusion or disrupt operations to demonstrate the issue. Reporting an accidentally discovered weakness in good faith is not itself prohibited. This reporting channel does not establish a bug-bounty program or authorize otherwise prohibited testing.

6. Resources, accounts and credits

Use execution resources for the supported development task, not as an independent computing service. Do not use workers for cryptocurrency mining, unrelated bulk processing, public proxy or relay services, production hosting, or storage and workloads unrelated to your authorized development work. Development servers, test databases, builds and application benchmarks genuinely needed for that work are not prohibited merely because they consume substantial resources.

Do not create false or duplicate identities to obtain allowances you are not entitled to, circumvent a suspension through another account, manipulate usage reports, or deliberately defeat credit deductions or disclosed technical limits. Legitimate membership in several teams or organizations is not itself abuse. Do not keep executions alive artificially to evade release or use retained environments to conceal prohibited workloads.

A negative credit balance, a costly authorized task, an unsuccessful task or an ordinary retry is not, by itself, a violation. The Terms permit an execution already running to consume more credits than the available balance. This AUP does not introduce a task-count allowance, an undisclosed spending cap, automatic overage billing or a cash debt merely because a balance is negative.

We may apply proportionate protective measures under Section 11 if activity materially threatens service security or availability, including when the problem is accidental. Those measures do not permit us to invent an undisclosed plan limit or charge. New or changed limits and prices remain subject to the Terms.

You may not resell access to our platform or its computing resources without our authorization. This does not prevent using the Service for authorized client work or commercially using, distributing or licensing Output as permitted by the Terms.

7. Project data, secrets and confidential materials

Submit only materials you are entitled to use and personal data necessary for the task. Prefer synthetic or appropriately minimized test data. Do not intentionally provide special-category personal data, criminal-offence data, live production datasets, payment-card data or information requiring special regulated handling unless we have expressly agreed in writing to support it with appropriate safeguards, as described in the DPA.

Do not expose production passwords, private keys or other production secrets in repository content, instructions, screenshots or logs. Use appropriately restricted test credentials and supported credential mechanisms. Do not instruct the agent to extract our managed credentials or transmit private project information to an unauthorized destination. The Security model explains the boundaries of the available controls; their existence is not permission to supply unsafe credentials.

If you discover exposed credentials or restricted data, stop further disclosure where reasonably possible, revoke or rotate affected credentials within your control, and contact us for assistance. Accidental submission does not remove the protection of the DPA or release us from our own duties. Our confidentiality, processing and deletion obligations continue to apply when investigating misuse.

8. Workflows, publication and Output

Do not use issues, comments, pull requests, webhooks or other integrations to send spam, harass others, impersonate an authorized user, or intentionally generate abusive execution loops. Do not disguise outside instructions as approval from a payer or use another customer’s credits without permission.

Supported follow-up work may run without a separate approval for every execution when you or an Authorized User have enabled the relevant workflow. A review or CI event may trigger work within that authorization; the event does not expand its scope. Disable unwanted workflows and manage repository permissions. Stopping an execution may not be immediate, and usage accounting remains governed by the Terms.

Review Output, reported checks and skipped checks before merging, deploying or distributing it. Do not represent Codebase.run checks as a security certification or falsely claim our endorsement. Publication can expose information according to repository visibility and can trigger your own CI, deployments or third-party charges. These review duties do not excuse our failure to supply the agreed Service.

9. Connected services and provider restrictions

Your activity must also comply with the relevant use restrictions of providers involved in that activity. They may prohibit some uses even where those uses are not unlawful. The relevant policy references are:

• OpenAI Usage Policies for tasks using OpenAI models or agents.
• DigitalOcean Acceptable Use Policy for activity on its execution and storage infrastructure, including the research-approval requirement in Section 5.
• Railway Acceptable Use Policy for activity using the application and hosting services it provides.
• GitHub Acceptable Use Policies for your connected GitHub account, repositories and publication, under your own arrangements with GitHub.

Do not instruct an agent to evade an applicable provider safeguard or use restriction. This includes attempting to route the same prohibited activity through another feature. Use restrictions are not limited to cyber abuse: an AI provider may restrict privacy-invasive uses, harmful assistance and certain sensitive applications.

These references concern relevant use restrictions, not wholesale incorporation of a provider’s pricing, indemnities, governing law or other commercial terms into our agreement. They do not grant a provider broader access to your data or replace our obligations under the Terms and DPA. We remain responsible for selecting and contracting with providers that support the processing we undertake for you.

A provider refusal is not automatically proof that you violated this AUP. We may explain an affected feature’s limits and refuse work that cannot be supplied lawfully or consistently with applicable provider restrictions. Material changes affecting our agreement follow Section 13; a provider’s webpage update does not, by itself, authorize an undisclosed new charge or retroactive penalty.

10. Reporting misuse or unlawful content

Send reports to hello@codebase.run. You do not need a paid account to report a concern. Include a clear explanation, the exact location or relevant repository, task or execution reference, and enough information to identify the affected material without accessing systems unlawfully. For a rights complaint, identify the right or work concerned and your relationship to it.

For a notice of alleged illegal content, include your name and email address, unless applicable law permits an exception, and a statement that you believe in good faith that the information in the notice is accurate and complete. Explain why the material is considered unlawful; include a legal reference where known. We will assess actionable reports and may request missing information. Do not knowingly submit false or abusive reports.

Do not attach passwords, unnecessary personal data, live malware or copies of child sexual abuse material. Provide locations and safe descriptions instead; ask us to arrange a suitable channel if sensitive evidence is necessary. We will acknowledge receipt where contact details are available and provide an appropriate outcome or follow-up, subject to confidentiality and legal restrictions.

Where applicable law requires additional notice-and-action steps or information, including under the EU Digital Services Act, we will follow those requirements. Reporting to us does not replace contacting emergency services where someone faces immediate danger.

11. Assessment and enforcement

11.1. How we assess concerns

Our assessment may use reports, relevant execution and security records, technical signals and proportionate review by authorized personnel. Automated permission, execution and provider safety controls may block individual operations. We do not represent that every input, dependency or Output is manually reviewed, that every abuse is detected, or that every blocked task is misconduct.

Access to private project content for an investigation remains limited to what is necessary and permitted by the Terms, Privacy Policy, DPA and applicable law. This AUP does not authorize unrelated monitoring, model training, publication of private code or unrestricted disclosure to a reporter or provider.

We consider the facts, actual or likely harm, scope, repetition, intent where relevant, steps taken to prevent or correct the problem, and whether activity resulted from compromise, malicious third-party content or an unexpected agent action. We may contain a risk before fault is established. An account-termination decision based on an alleged AUP violation will receive human review.

11.2. Measures and notice

Depending on the circumstances, we may refuse or stop an affected task, limit an integration or feature, isolate or disable access to affected material within our control, ask you to correct a problem, or suspend or end access under Section 15 of the Terms. Measures must be proportionate and consistent with applicable law. A stop instruction is not a promise of instantaneous termination of every process.

Where reasonably possible, we will explain the concern and provide an opportunity to resolve it before suspension. Immediate protective action may be necessary where delay would create harm or violate law. Termination follows the Terms, including their seven-day opportunity to correct a material breach and their exceptions for serious or repeated abuse or legal requirements. This AUP does not introduce a separate right to terminate without cause or notice.

For a restriction, we will provide the relevant factual and contractual or legal reasons, its scope and duration where known, and information about review. Where required, we will also explain the role of automated means. We may withhold only information that law requires or permits us to withhold, including protected personal information or security-sensitive details, without omitting a legally required explanation.

11.3. Payments, data and third-party systems

A restriction does not automatically forfeit all payments or credits. Usage, corrections, refunds and liability remain governed by the Terms and mandatory law. We add no contractual fine or new indemnity through this AUP.

We will preserve lawful retrieval, return and deletion rights under the Terms and DPA, subject to any lawful restriction on the affected material. We will not retain an entire project indefinitely simply because a report was made. Suspension does not give us a blanket right to delete content from your GitHub repositories or change external systems beyond our permissions and legal authority.

Disclosures to authorities and preservation of evidence must have an applicable lawful basis and remain consistent with confidentiality and data-protection obligations. We do not promise to report every allegation or disclose private data merely because someone requests it.

12. Review of a decision

You may ask us to reconsider an AUP decision by emailing hello@codebase.run with the account or decision reference, an explanation and relevant supporting information. A person will review the request, taking account of your explanation and any corrected circumstances. Ordinary review does not require payment or purchase of another plan.

We will respond under the complaint procedure in Section 14 of the Terms, including its 14-calendar-day response period or a shorter mandatory deadline. That is not a guarantee that every investigation or technical remedy will be completed within that period. We will explain the outcome and correct an unfounded restriction without undue delay.

A proportionate protective restriction may remain during review where its grounds still exist. This procedure does not limit any statutory complaint, appeal, regulator, court or other redress right, and is not a mandatory prerequisite to exercising those rights. Any additional legally required review procedure remains available.

13. Changes and relationship to other documents

This AUP becomes part of your agreement through the Terms acceptance or change process that identifies and incorporates it. Merely publishing this page does not retroactively establish your acceptance of new contractual obligations. We retain the accepted version and make it available in a form you can save.

Changes follow Section 17 of the Terms, including its justified reasons, advance notice of material adverse changes, express acceptance where required, and rights concerning affected prepaid services. We do not reserve an unrestricted right to change this AUP without notice. A necessary urgent legal or security measure remains subject to the Terms and applicable law. New restrictions are not applied retroactively to establish a past breach.

If documents conflict, mandatory law and binding transfer clauses prevail; the DPA prevails for processing personal data on your behalf; and the Terms control the wider contractual relationship, including payments, termination, remedies and liability. This AUP supplies the more specific acceptable-use rules within that framework and does not override those protections. It neither expands our license to Customer Content nor restricts the lawful commercial use of Output permitted by the Terms.

14. Contact

Codebase.run is operated by 1xTeam sp. z o.o.

Jana Kazimierza St. 11B/29, 01-248 Warsaw, Poland. NIP: 5223035587. KRS: 0000571058. REGON: 362256087.

Email: hello@codebase.run. Telephone: +48 794 044 144.

Use this contact for acceptable-use questions, reports, security-research authorization requests and review of restrictions. This AUP does not establish 24/7 support or an emergency-response service.