# Coreload Acceptable Use Policy

Last updated: 6 November 2026.

This policy is part of the Coreload Terms of Service. It covers everything your jobs, sandboxes, installations and
keys do, and anyone you let use them.

## Not allowed

You will not use Coreload, or let anyone use it, to:

- **mine cryptocurrency**, or run any work whose main purpose is to turn our compute into value for you, such as
  proof-of-work, plotting or farming;
- **attack anyone:** scan, probe or test the security of systems without their owner's permission, flood or overload
  networks or services (denial of service), break into systems or accounts, or stuff or crack credentials;
- **spread harm:** distribute malware or ransomware, run botnets or command-and-control servers, phish, or run scams
  or fraud;
- **send spam** or any other unsolicited bulk messages;
- **host or send illegal content**, including child sexual abuse material, content that infringes someone's
  intellectual property or privacy, or material that promotes terrorism or violence;
- **break the law**, including export control and sanctions laws;
- **get around our limits or isolation:** escape a VM, reach Coreload's other systems or other customers' work, evade
  the network limits, rate limits or the GitHub App's permissions, or test Coreload's security without our written
  permission;
- **misuse the capacity:** run proxies, VPN or Tor exit nodes, open relays or public services for third parties; keep
  jobs or sandboxes alive doing nothing to hold capacity; or use the service as a content delivery network;
- **resell it:** sell or share access to the service, your installation or your keys, or run hosted-CI jobs from
  public repositories or from repositories you did not choose when you installed the App.

## Network limits

Outbound traffic is limited per VM and per machine: the number of connections, new connections per second, new
destinations per minute and bandwidth. The limits are not published and may change. Outbound mail ports are refused,
and so are mining-pool and IRC ports and DNS other than the resolver we provide. Work that needs more must be agreed
with us in writing first.

## Shared addresses

A job's outbound traffic leaves from addresses that other customers share, and that can change without notice. Do not
put them in an IP allow list, and never treat traffic from them as proof that it is yours.

## What happens if this policy is broken

We may stop the job, suspend the organization, installation or key at once, and end the service, as the Terms of
Service say. Where the law requires it, we report illegal content and activity to the authorities.

## Reporting abuse

Report abuse coming from Coreload to hello@coreload.com, and a security problem in Coreload to hello@coreload.com.
Tell us what you saw, when, and from which address.