Acceptable Use Policy — Security Research

Security Research 層は, 認可された合法的なセキュリティ業務のための無制限モデルを提供します. アクセスは検証済みのセキュリティ専門家に付与され, 本ポリシーに従います. 悪用は即時失効となります.

Assurance Ladder(Assurance Ladder)

各レベルが満たすべきEvidenceと, 解禁される 1 日あたりトークンAllowance. カード登録(レベル1)で無料研究枠が開き, 本人確認・ガバナンス確認(レベル2以降)で上限が上がります.

1. Payment method on file

   Evidence: a live credit/debit card (prepaid rejected) verified with a $0 check

   無料枠: 1 日（UTC）50 リクエスト

   Allowance: 102400 tokens/day · 上限 102400

2. Identity verified

   Evidence: optional: a Stripe Identity document + selfie check bound to the principal, on top of the card

   Allowance: 102400 tokens/day · 上限 200000

3. Business verified

   Evidence: a company on a public registry, a proven domain claim, clean screening

   Allowance: 2000000 tokens/day · 上限 8000000

4. Contracted researcher

   Evidence: named researchers, a signed authorized-scope statement, a contract

   Allowance: 8000000 tokens/day · 上限 32000000

Allowed uses

• Vulnerability research
• Exploit and proof-of-concept (PoC) development
• Malware analysis and deobfuscation
• Reverse engineering
• Authorized phishing and social-engineering assessments

Strictly prohibited

• Child sexual abuse material (CSAM)
• Chemical, biological, radiological, nuclear weapons or other weapons of mass destruction (CBRN/WMD)
• Large-scale fraud-as-a-service

CSAM and CBRN/WMD content is strictly blocked; confirmed cases are handled through our incident and abuse process.

攻撃的機能(条件付き)

Payload and shellcode development, command-and-control (C2) tooling and weaponized exploits are permitted only inside a live engagement you have attested to — a named client, a named scope and an end date — at the contracted rung, on top of this policy.

Privacy

• 内容は利用ポリシー適合のため審査されます。
• 基盤モデルの学習・ファインチューニングには使用しません。
• チャット・調査コンテンツはアカウント削除まで運営者サーバーに保存されます。詳細はプライバシーポリシーおよび利用規約。

ローカル実行境界

• The service never executes tools, code, commands or network actions server-side; a tool call the model emits is returned to the caller as data (tool_calls) and runs, if at all, on the caller's own machine
• Tool use, command execution and automation stay entirely on the user's local machine, driven by the user's own agent
• Generated exploit or payload text is data returned to the caller — it is never run by kotoba.cloud

Version: kotoba-security-aup-v1