Responsible use. Clear boundaries.
Version 2026-10-16 · Effective 16 October 2026
1. Platform, scope and acceptance
These general platform terms govern the BugHood website, invitation-only researcher workspace, report delivery portal and agent submission API. In these terms, BugHood means the operator of this platform, reachable at BugHood@proton.me; BugHood is a service name, not a representation of a particular registered company. Effective 16 October 2026. By expressly accepting these terms, you agree to them for your use of the workspace and integrations. If acting for an organization, you represent that you are authorized to bind it. If you do not agree, do not submit data or use the workspace. An invitation, account or API key does not authorize security testing.
2. Eligibility and account security
Use only your own invited account and accurate name or permitted alias. Do not transfer invitations, impersonate others, share passkeys or recovery codes, or bypass access restrictions. Keep passkeys, offline recovery downloads and integration credentials secure. Promptly notify the operator through the confirmed legal/security contact if an account or credential may be compromised. You remain responsible for authorized users and agents you configure.
3. Authorized research only
You must have the necessary permission and remain within the target owner’s scope, rules and applicable law. BugHood supplies a reporting channel, not authorization, a safe-harbor promise or legal immunity. Stop testing if authorization is uncertain or harm is possible. Do not use the service for unauthorized access, persistence, destructive testing, service disruption, extortion, credential theft, exploitation of unrelated people, or sale of illicit access.
4. Reports, evidence and minimization
Submit only information you may lawfully disclose and that is reasonably necessary to explain the finding. Minimize personal data and redact credentials, access tokens, unrelated records and third-party confidential material. Do not upload malware, executables, illegal material or unsupported active content. Distinguish verified observations from hypotheses. You are responsible for checking accuracy, reproduction steps, sanitization results and each approved rendition before release. Automated processing cannot guarantee that every identifier or secret is removed.
5. Ownership and limited processing permission
You retain whatever rights you hold in your submissions. You grant only the permission necessary to host, encrypt, process, reconstruct evidence, back up and deliver submissions to recipients you authorize, subject to these terms and applicable law. This does not transfer ownership or grant a general publication, sale, model-training or marketing license. Do not submit content whose third-party rights prevent these operations. Publication outside your authorized disclosure process requires a separate lawful basis and any necessary permissions.
6. Confidentiality and administrator boundaries
Researchers cannot access other researchers’ reports. Administrator accounts manage invitations, account state and operational metadata such as report identifiers, ownership, lifecycle, timestamps and evidence counts; that role does not grant access to another researcher’s titles, targets, severity, report text, evidence or sharing credentials. This is an application authorization boundary, not end-to-end encryption: the running server, its encryption keys and privileged infrastructure operators can technically access plaintext. Compromise, lawful obligations and hosting-provider access remain risks. Confidentiality is not a promise of anonymity or immunity from legal process.
7. Delivery and recipient responsibilities
Only share reports with appropriate authorized recipients through an agreed disclosure channel. Report links require a separate code; sending both in one channel creates a single-channel compromise risk. Recipients must protect codes, limit onward disclosure to authorized remediation personnel, and not misuse evidence or access another report. Access can expire or be revoked. Revocation cannot recall information already viewed, copied or downloaded. This service does not promise a bounty, payment, response time or remediation outcome.
8. Agents and external AI
You must explicitly issue scoped, expiring credentials and supervise agents acting for you. Never place API keys in reports, prompts, URLs or logs. Agents may submit only their permitted drafts and quarantined evidence; they cannot approve evidence, publish, share or administer accounts. Human takeover permanently stops agent writes. The portal does not send report data to external LLMs by default. Your separately configured agent, model provider, browser extensions and local tooling may receive data outside BugHood; assess and authorize that disclosure yourself. Treat report content as untrusted data, not instructions to execute.
9. Privacy, retention and backups
The Privacy notice describes operational records, encryption and retention. Routine audits avoid report bodies, access codes and raw visitor IP addresses. Hosting and network providers may keep their own records. Unapproved originals normally expire after 24 hours or are removed after approval; encrypted rolling backups do not support instant erasure. Do not treat BugHood as your sole archive. Deletion, retention, preservation and incident response must comply with applicable law; the operator must not promise unconditional deletion where lawful preservation is required.
10. Abuse, suspension and termination
The operator may restrict credentials, suspend access or remove material reasonably needed to address suspected abuse, security incidents, legal requirements or material violations. Suspension does not grant administrators permission to read a researcher’s report through the application. Where safe and lawful, BugHood will provide an explanation and a contact channel to contest errors or request authorized export or closure. You may stop using the service and request account closure through the contact above. No guaranteed availability or recovery of deleted material is offered. Confidentiality, accrued rights and restrictions on misuse continue after access ends.
11. Warranty disclaimer and risk
To the fullest extent permitted by applicable law, the platform is supplied as is and as available, without express or implied warranties, including merchantability, fitness for a particular purpose and non-infringement. BugHood does not warrant uninterrupted availability, perfect security, exhaustive sanitization, accurate agent output, anonymity or legal protection. You are responsible for lawful testing, reviewing submissions and maintaining independent backups. Do not rely on the service for emergency response or as a substitute for independent technical and legal advice. Third-party services, model providers, password managers and hosting/network providers are outside the platform’s control.
12. Liability and user responsibility
To the extent permitted by applicable law, BugHood is not liable for indirect, incidental, special or consequential loss, lost profits, lost opportunities or business interruption arising from use of or inability to use the platform. You are responsible for harm caused by your unauthorized testing, unlawful submissions, misuse of credentials or configured agents, and material breach of these terms. To the extent lawful, you agree to indemnify the operator against third-party claims and reasonable costs directly arising from that conduct, excluding loss attributable to the operator’s own unlawful conduct. The operator must notify you of an indemnified claim and allow reasonable participation in its defense; no settlement imposing obligations on you may be agreed without your consent. Nothing excludes or limits liability for fraud, willful misconduct, gross negligence, death or personal injury where prohibited, or any liability or statutory right that cannot lawfully be excluded or limited. No clause overrides mandatory consumer or privacy protections.
13. Changes, notices and disputes
Material amendments receive a new version and effective date, notice through the workspace and renewed express acceptance before continued workspace or integration use, with advance notice where legally required. Previously accepted versions are preserved. Contact BugHood@proton.me for notices, security concerns, complaints, account closure and rights requests. Please first try to resolve disputes in good faith through that contact; this does not restrict access to courts, regulators or urgent remedies. These general terms do not select a governing jurisdiction, exclusive court, mandatory arbitration or class-action waiver. Applicable conflict-of-law and mandatory legal rules determine those questions. If a clause is unenforceable, the remaining terms apply to the extent lawful. A delay in enforcement is not a waiver.
14. Cross-border users and mandatory rights
Availability in the United States, Europe or Israel is not a claim that every use is lawful everywhere. Each party must comply with applicable law, including mandatory privacy, consumer, intellectual-property and disclosure obligations. Accepting these terms is not blanket consent for unrelated processing, marketing, model training or overseas transfers, and is not a substitute for any required data-processing or transfer agreement. Contact BugHood before uploading regulated or special-category personal data or data requiring contractual safeguards not provided by this platform. Mandatory rights remain unaffected.
Legal and security contact: BugHood@proton.me. Read the Privacy notice alongside these terms.