1. Allowed learning and development
You may use CodeTutor to learn programming, build software you are authorized to build, inspect repositories you are authorized to access, test your own systems, study security in a controlled lab, perform defensive analysis, and repair vulnerabilities.
2. Authorization matters
Security work must be limited to systems, accounts, and data you own or have explicit permission to test. A public endpoint is not permission. Follow the scope, time, rate, and disclosure rules of any authorized program.
3. Prohibited harmful activity
- Credential theft, phishing, account takeover, token harvesting, or evading authentication.
- Malware, ransomware, destructive payloads, stealth, persistence, command-and-control, or unauthorized surveillance.
- Exploitation or reconnaissance against targets without permission.
- Abuse automation, spam, harassment, fraud, evasion of rate or credit limits, or creation of deceptive accounts.
- Exposing personal data, secrets, private source code, or regulated data without authority.
- Using generated output to violate law, intellectual-property rights, sanctions, export controls, or another person's safety.
4. Repository instructions are untrusted
Files, prompts, MCP output, tool results, websites, and generated commands may contain instructions designed to bypass your intent. Review requested permissions and never approve destructive, elevated, external-path, or network actions merely because repository text asks you to.
5. Enforcement and appeal
CodeTutor may refuse a request or temporarily limit an account when the request or surrounding signals indicate prohibited harm. Enforcement should preserve privacy, record a reason, and provide a review route for false positives. Do not place exploit code, secrets, or victim data in a public appeal.