1. The premise
You have root on a machine with its own public address, on every port. That is the point of the service, and it means the rules here are not about what you run on your machine — they are about what your machine does to other people’s. Breaking them harms a third party, gets our address space blocklisted, or both, so they are enforced.
2. No attacks on systems that are not yours
Do not scan, probe, exploit, flood, brute-force or otherwise attack any system, network or account you do not own or have written authorisation to test. This includes credential stuffing, denial of service of any size, and “just checking” a port.
Offensive-security labs are welcome — the platform was built for teaching them — against targets you own, targets inside your own workspace or VPN, or targets whose owner has authorised you in writing. Keep that authorisation; if a complaint reaches us we will ask to see it. A CTF you are hosting for your own students is fine. A student pointing a lab at a university they do not attend is not.
3. No spam, and port 25
Outbound TCP port 25 is closed on every workspace by default. Bulk or automated email must go through an authenticated relay (ports 465 or 587) whose recipients have agreed to receive it. No unsolicited bulk email, no purchased lists, no phishing, no forged headers. If you run a real mail server and need port 25, ask at support@selfmade.ninja; we open it for accounts with a reason and a reverse DNS record.
4. No cryptocurrency mining without consent
Mining and similar sustained proof-of-work loads are not permitted unless we have agreed to it in writing first. This is about capacity: the machines are sized for labs, and one miner changes the thermal and power profile of a host that thirty tenants share.
5. No illegal content or activity
Nothing that is illegal in India or where you are: child sexual abuse material, material that incites violence or terrorism, content that infringes someone’s copyright or trade mark, the sale of controlled substances or weapons, fraud. Malware samples for research may be stored and analysed inside a contained lab; they may not be served, distributed or detonated against anything outside it.
6. No interference with the platform or other tenants
- Do not attack, probe or attempt to escape the hypervisor, the control plane, this console or another tenant’s workspace.
- Do not spoof source addresses or advertise addresses that are not yours.
- Open relays, open proxies, Tor exit nodes and the resale of raw network access are not permitted without our written consent.
- Your workspace gets the CPU, memory, disk and network in its plan. Sustained behaviour that degrades the host for others — a packet flood, a fork bomb left running — may be throttled or the workspace stopped.
7. AI agents
An agent you connect through the MCP server acts with your authority, and this policy applies to everything it does exactly as if you had typed it. Scope its token to what it needs, watch what it does, and revoke the token when the task is done. “The agent did it” is not a defence.
8. How we enforce this
- Notice. When we receive a complaint or detect a breach, we email the account holder and the security contact (if one is named) with what we saw and what has to change. Except in an emergency you get time to fix it — usually 24 hours, less if third parties are being harmed while we wait.
- Suspension. If it is not fixed, or the harm is ongoing, we take the workspace off the network. Its disk is kept. You can reach us and we can reach the machine; the internet cannot.
- Termination. For serious or repeated breaches we delete the workspace and may close the account. Prepaid fees are not refunded in this case.
- Preservation. Where the law requires or a lawful order asks, we preserve evidence of the breach for the period required before deleting anything.
Suspension and termination decisions can be appealed by replying to the notice. A person reads the appeal.
9. Reporting abuse
If a machine on our network is attacking you, spamming you or hosting something it should not, write to abuse@selfmade.ninja with the source IP address, timestamps in UTC, and the log lines or headers that show it. We aim to acknowledge within one business day and to act within the notice period above. Rights-holder takedown requests go to the same address and should identify the work, the location of the infringing copy, and the person making the claim.
A vulnerability in the platform itself — the console, the control plane, the hypervisor — is a different thing from abuse by a tenant; see /security.