This policy applies to everyone using Shimpilot and forms part of our Terms of Service.

You must not use Shimpilot to:

• Break the law, or help anyone else do so.
• Access, scan, or open pull requests against repositories you are not authorized to modify.
• Steal, harvest, or attempt to extract credentials, tokens, or secrets.
• Build, host, or distribute malware, or introduce malicious code into any repository.
• Harm third parties, including through code changes proposed via the service.
• Process personal or regulated data you have no authorization to process.
• Violate the terms of GitHub or of any API provider Shimpilot monitors.

By connecting a repository you represent that you are authorized to grant read access and to allow branches and pull requests to be created on it. Connecting a repository belonging to an employer, client, or third party without that authorization is a breach of this policy and may also breach your agreements with them.

Shimpilot retrieves public changelogs and specifications from API providers on a rate-limited schedule. You must not use the service to circumvent provider rate limits, generate excessive automated requests, or otherwise place unreasonable load on a third-party API.

You must not:

• Attempt to access data belonging to another organization or user.
• Probe, scan, or test the security of the service without our written permission — except to report a vulnerability responsibly, as described on our Security page.
• Circumvent rate limits, authentication, plan limits, or usage controls.
• Reverse engineer restricted parts of the service, except where that right cannot lawfully be excluded.
• Submit content designed to manipulate the behaviour of automated analysis or AI components, including instructions embedded in code or documentation intended to alter Shimpilot's output.
• Interfere with, overload, or disrupt the service or its infrastructure.

We may investigate suspected breaches and may suspend or terminate access, disable a GitHub App installation, or remove content, with or without notice depending on severity. Where a breach appears to involve unlawful activity, we may report it to the appropriate authorities.

Report suspected abuse to privacy@shimpilot.com. Report security vulnerabilities to privacy@shimpilot.com.