通俗说明
- 仅限防御性用途：连接和分析您拥有或获得明确授权管理的环境。
- Never use the platform to scan, enumerate, or probe systems belonging to someone else. The one exception is the AI Exposure Check, which reads only the public DNS records of a domain you enter and returns only a score, counts and status flags.
- AI功能在下游附带Anthropic使用政策义务——不得用于有害或攻击性用途。
- 违规可能导致暂停服务；在法律要求时我们将进行举报。
1. 目的
8200.dev是一个防御性安全平台。本政策界定可接受的使用方式，并构成服务条款的一部分。我们构建该平台是为了帮助组织保护其自身数据——并且我们会强制执行这一界限。
3. 禁止行为
您不得：
- Scan, enumerate, or analyze third-party systems, tenants, or accounts without explicit authorization, except for the AI Exposure Check as described in section 3A.
- 利用本平台或其生成的信息，针对任何一方策划或支持攻击性作业、漏洞利用、横向移动或社会工程攻击。
- 通过本平台开发、测试或投放恶意软件或其他有害代码。
- 探测、干扰或试图访问本平台的其他租户，或规避速率限制、套餐限制或安全控制措施。
- 在未与我们签订书面协议的情况下，为第三方转售、再许可或运营本平台。
- 向第三方将发现结果呈现为 Enterprise.Systems 作出的认证、审计意见或合规证明。
- 以违反适用法律的方式使用本平台，包括计算机滥用、隐私及出口管制法律。
3A. The AI Exposure Check
The AI Exposure Check may be run on any public domain name, including one you do not own, because it reads only public DNS records and returns only a score, counts and status flags: no service names, subdomains or record values. It is the only analysis of systems you do not own that this policy permits.
Only the domain you enter. The check asks public DNS resolvers about that domain (a subdomain is checked as its main domain) and, to read its mail settings and the services it uses, the names its own records refer to and a fixed list of common names under it (for example www, autodiscover and DKIM selectors). You must not use the check, or ask us, to look at anything else. The check does not run port scans, login attempts, password guessing, brute force, vulnerability scans or exploitation against any domain, and we do not connect to the domain’s servers or website ourselves; the public resolver may query the domain’s name servers, as normal DNS resolution does.
Limits. For each network (for IPv6, each /64 network) the check allows 5 new checks per hour, 20 new checks per day, 60 answers per day (saved answers included) and 30 different domains per day. Each network may also create 20 share links and submit 5 e-mail sign-ups per day. A signed-in account may run 50 new checks per day instead of the 5 per hour and 20 per day. Each domain is checked afresh at most once per UTC day, and we also cap the total number of new checks per day. Days are UTC. When you reach a limit, the check says so.
No circumvention and no list-building. You must not get around the limits or the human check, for example with scripts or other automation, rotating IP addresses or networks, proxies or multiple accounts. You must not use the check to build lists, rankings or databases of other organizations, for sales prospecting, competitive intelligence or targeting, or to harass or shame an organization.
Sharing. You may share your own result card. You must not present a result as a rating, certification or audit of another organization.
Opting out and reporting. There is not yet a way for a domain owner to opt out of the public result. Report abuse of the check to [email protected] (section 7).
4. AI 使用义务
AI 功能由 Anthropic 模型依据 Anthropic 的商业条款及使用政策提供支持。这些义务向下传递至您：您不得使用本平台的 AI 功能生成或支持有害的、欺骗性的或攻击性安全的应用，且您不得试图提取、越狱或改用底层模型。当我们怀疑存在违反上述向下传递义务的情形时，可暂停 AI 功能。
5. API 与速率限制
自动化访问必须遵守已公布的速率限制及套餐限制。禁止滥用性自动化行为——包括针对生产环境的负载测试、抓取本平台，或旨在扭曲发现结果的合成流量。
6. 执行
我们会调查涉嫌的违规行为，并可暂停或终止访问、移除违规工作负载，且——在法律要求或第三方处于危险之中时——通知受影响方或主管机关。在可行的情况下，我们会在暂停之前发出通知并给予纠正机会。
7. 举报
如发现涉嫌违反本政策的行为或本平台的漏洞，请举报至 [email protected]。我们力求在 48 小时内确认收到安全报告，遵循 90 天的协调披露窗口期，并且不会追究善意研究人员的责任。
8. 变更与联系方式
随着平台及威胁形势的演变，我们可能更新本政策；重大变更遵循 Terms of Service 中的通知流程。如有疑问：[email protected]。