Acceptable Use Policy

The central rule: you may only register, broker access to, or execute commands against infrastructure you own or are contractually authorized to administer.

Registering a target in Shortspan is a representation that you hold that authorization. Using the Service to reach a system you do not have permission to access is prohibited regardless of whether the access technically succeeds.

Unauthorized access and attack

• Accessing, probing, or scanning any system without authorization from its owner.
• Using Shortspan as a pivot, relay, or command-and-control channel in an intrusion.
• Brokering credentials to infrastructure obtained through fraud, theft, or a compromised account.
• Conducting a penetration test against a third party without documented written authorization from that party.

Attacking the Service itself

• Circumventing authentication, rate limits, plan limits, or the audit trail.
• Denial-of-service, resource exhaustion, or deliberately abusive request volume.
• Load or stress testing without our prior written consent.
• Automated scraping of the Service, or reselling access without a written agreement.

Unlawful and harmful content

• Storing or transmitting material that is unlawful, that infringes intellectual property, or that constitutes child sexual abuse material.
• Using the Service in furtherance of fraud, extortion, ransomware, phishing, or malware distribution.
• Using the Service in violation of applicable export control or economic sanctions law.

Undermining the audit trail

• Sharing a personal account, session token, or device authorization between people to obscure who took an action.
• Registering a principal under a false identity to defeat approval workflows.
• Altering, suppressing, or falsifying audit records, or attempting to.

• Grant the narrowest role that lets each person do their job, and review grants periodically.
• Require multi-factor authentication or passkeys for anyone with administrative rights.
• Revoke devices and tokens when someone leaves or a machine is lost - the same day, not the same quarter.
• Keep host key fingerprints pinned, and investigate a mismatch rather than overriding it.
• Keep your CLI reasonably current so you receive security fixes.

Good-faith research against Shortspan is welcome and is exempt from the prohibitions above when carried out within the scope and rules of our vulnerability disclosure policy. Research outside that scope - particularly anything touching another customer’s Workspace - is not exempt.

If you are unsure whether a test is in scope, ask security@shortspan.dev before you run it. We answer quickly.

Where we identify a breach, our response is proportionate: usually a warning and a request to remediate, sometimes suspension of a specific token, device, or user, and in serious cases suspension or termination of the Workspace.

We may act immediately and without prior notice where continued operation presents an imminent risk to the Service, to other customers, or to a third party. We will explain the reason as soon as it is safe and lawful to do so, and we will restore access if the report turns out to be wrong.

We cooperate with law enforcement where we are legally required to, and we require valid legal process before disclosing customer information.

Report suspected abuse of Shortspan to abuse@shortspan.dev. Include the timeframe, any identifiers you have, and what you observed. Reports about a security vulnerability in the Service itself should go to security@shortspan.dev instead, under our disclosure policy.