Terms of service

Malprompt checks public code and pastes for prompt injection — hidden instructions written to hijack an AI assistant that reads them — and publishes what it finds. These terms are the agreement between you and Malprompt when you use the site, the feeds or the API. We've kept them readable on purpose.

What Malprompt does

You give us a public URL. We fetch what's there, analyze it for prompt injection, score what we find, and a person reviews the result before anything goes public. Published reports appear on the Wall, in the feeds and in the API.

We only accept links that are already public — GitHub, Bitbucket and Pastebin URLs anyone could open. We don't accept private repositories, we never ask for credentials to reach one, and we have no way to look behind a login. If a link needs a password, it isn't for us.

Using the service

Fair use, in plain terms:

• Submit links you're comfortable making public. Any submission can become a public report.
• Don't use Malprompt to harass anyone, to build a case against a person rather than a payload, or to publish someone's private information.
• Don't attack the scanner: no attempts to make the analyzer run code or follow instructions it finds, no flooding, no working around quotas with scripts or throwaway accounts.
• Don't scrape the site. The feeds and the API are free and exist so you don't have to.
• One account per person. Your password and your API keys are yours to look after — anything done with your key counts as done by you.

We enforce this with quotas, rate limits and, when we have to, blocks. We'd much rather hear from you than block you: if you need room for something legitimate, write to [email protected].

What we do with what you submit

• A submitted URL is public information and we treat it that way. It can appear in a published report along with what we found there.
• Fetched content is evidence. We keep it so a reviewer can check the analysis and so a later scan can tell whether anything changed. We never run it. Payload text shown publicly is always defanged — links broken, invisible characters made visible, nothing executable or clickable.
• Your email address is never published. It identifies your account and lets us tell you when something you submitted goes live. The privacy policy has the details.
• Reports are about content, not people. We describe what a file does, not who we think wrote it or why.

If you own or maintain something we published and we got it wrong — or you've fixed it — use the dispute path on the report. We answer every dispute. See Disputes and remediation.

What a report is, and isn't

A report is our assessment of publicly available content at a point in time. It is not an accusation of wrongdoing and not a legal finding. Scans can be wrong in both directions: harmless content can look hostile, and a careful payload can slip past us. Treat a report as evidence to look at, not as a verdict, and never assume that content we didn't flag is safe.

We correct or remove a report when it's wrong. We keep one when it's right, even if the person who published the content would rather we didn't.

No warranty

Malprompt is provided as is and as available. We don't promise the site will be up, that a scan will catch every injection, that a score is correct, or that a clean report means content is safe to hand to an agent. This is one signal among several — keep your own judgement in the loop.

Limit of liability

To the fullest extent the law allows, Malprompt and the people who run it are not liable for indirect, incidental or consequential loss, lost data, lost profits, or anything that follows from relying on a report. Where liability can't be excluded, it is limited to what you have paid us, which today is nothing.

Nothing here limits liability for fraud or for anything that can't be limited under the law that applies to you.

Your account

You can stop using Malprompt whenever you like. Ask us at [email protected] and we'll delete your account and the rows attached to it. Published reports stay — they describe public content, not you.

We can suspend or close an account that is being used to attack the service or to harm someone. Where we can explain why, we will.

Changes

We'll revise these terms as the product grows. The date on this page is when it was last updated. If a change affects what we publish or what we do with your data, we'll say so on the site instead of quietly editing the page.

Governing law

[Jurisdiction — to be confirmed]

The operating entity and the governing law for these terms are not settled yet. We would rather leave this visibly blank than name a jurisdiction we haven't confirmed. It will be filled in before Malprompt charges anyone for anything.

Contact

[email protected] reaches a person.