74 lines
2.9 KiB
Markdown
74 lines
2.9 KiB
Markdown
|
# Acceptable Use Policy
|
||
|
|
|
||
|
|
Overlord is intended for lawful administration, support, testing, and
|
||
|
|
management of systems whose owners have given informed authorization.
|
||
|
|
|
||
|
|
By using or distributing this project, you are responsible for complying with
|
||
|
|
applicable law, contractual obligations, organizational policy, and the terms
|
||
|
|
of every network and service involved.
|
||
|
|
|
||
|
|
## Authorized use
|
||
|
|
|
||
|
|
You may use Overlord for purposes such as:
|
||
|
|
|
||
|
|
- Managing devices you own or are explicitly authorized to administer.
|
||
|
|
- Providing remote support with the device owner's or organization's consent.
|
||
|
|
- Operating an approved enterprise, laboratory, classroom, or homelab
|
||
|
|
environment.
|
||
|
|
- Conducting a documented security assessment within its agreed scope.
|
||
|
|
- Developing and testing defensive controls in an isolated environment.
|
||
|
|
|
||
|
|
Authorization should identify the systems, accounts, operators, capabilities,
|
||
|
|
data-handling rules, and time period in scope. An accessible device is not
|
||
|
|
necessarily an authorized device.
|
||
|
|
|
||
|
|
## Prohibited use
|
||
|
|
|
||
|
|
Do not use Overlord to:
|
||
|
|
|
||
|
|
- Access, monitor, control, enroll, or persist on a system without explicit
|
||
|
|
authorization.
|
||
|
|
- Collect credentials, keystrokes, audio, video, files, communications, or
|
||
|
|
personal data without a lawful purpose and appropriate consent.
|
||
|
|
- Conceal activity from a system owner or bypass required security,
|
||
|
|
privacy, monitoring, or consent controls.
|
||
|
|
- Deploy malware, ransomware, destructive payloads, or unauthorized
|
||
|
|
cryptomining.
|
||
|
|
- Exfiltrate, sell, publish, or misuse confidential or personal information.
|
||
|
|
- Disrupt services, damage systems, interfere with other users, or evade
|
||
|
|
incident response.
|
||
|
|
- Violate sanctions, export restrictions, intellectual-property rights, or
|
||
|
|
third-party service terms.
|
||
|
|
- Help another person perform any prohibited activity.
|
||
|
|
|
||
|
|
## Operator responsibilities
|
||
|
|
|
||
|
|
Operators must:
|
||
|
|
|
||
|
|
- Use individual accounts and least-privilege permissions.
|
||
|
|
- Restrict agent enrollment and promptly revoke unauthorized or retired
|
||
|
|
clients.
|
||
|
|
- Protect credentials, signing material, tokens, recordings, logs, and
|
||
|
|
transferred files.
|
||
|
|
- Notify affected users and obtain consent where required.
|
||
|
|
- Configure appropriate retention and securely delete data when it is no
|
||
|
|
longer needed.
|
||
|
|
- Maintain audit records sufficient to attribute administrative actions.
|
||
|
|
- Stop testing when it creates unexpected risk or exceeds the approved scope.
|
||
|
|
|
||
|
|
## Plugins and modifications
|
||
|
|
|
||
|
|
Plugins, custom builds, scripts, and downstream modifications remain subject
|
||
|
|
to this policy. Their authors and operators are responsible for reviewing the
|
||
|
|
additional permissions, data access, network behavior, and security impact
|
||
|
|
they introduce.
|
||
|
|
|
||
|
|
## Reporting misuse
|
||
|
|
|
||
|
|
Report project security vulnerabilities according to
|
||
|
|
[SECURITY.md](SECURITY.md). For suspected misuse, preserve relevant
|
||
|
|
non-sensitive evidence and contact the service operator or appropriate
|
||
|
|
authority. Do not publish credentials, tokens, personal data, or exploit
|
||
|
|
details in a public issue.
|
||
|
|
|