API Acceptable Use Policy

We provide planning, code generation, GitHub actions and deploys for software projects. Deploys and self-heal run against your own accounts, using tokens you provide. Use the service only for lawful software work.

Requests are limited per network, per account and per API key, by the minute, hour and day. When you go over a limit, the HTTP API responds with status 429, a Retry-After header in seconds, and a JSON body with code "rate_limited" and retryAfter. The MCP endpoint returns a rate_limited tool error with the wait time in the message.

HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: application/json

{"error":"Too many requests.","code":"rate_limited","retryAfter":60}

Always wait at least Retry-After seconds. If there is no header, back off exponentially with jitter:

T_wait = min(T_max, T_base × 2^attempt) + random(0, J)

For example T_base = 1 s, T_max = 60 s, J = 1 s. Stop after a few attempts instead of retrying forever.

Paste provider tokens (GitHub, Cloudflare, OpenAI and others) only into the designated token fields, for example in Settings → Connections. A token is used for that request only, unless you tick Remember; remembered tokens are stored encrypted and you can remove them at any time. Never paste tokens, passwords or keys into chat prompts.

• Prompt injection or jailbreak attempts against our models or tools.
• Trying to extract system prompts, credentials, keys or other users' data.
• Generating malware, backdoors, credential stealers or exploit code aimed at systems you do not own.
• Typosquatting or dependency confusion: publishing or referencing look-alike packages.
• Scraping, or evading rate limits by rotating IPs, spoofing TLS fingerprints or creating many accounts.
• Deliberately exhausting quotas or resources so others cannot use the service.

Generated code, scripts and commands can be wrong. Review every script before you run it on your machine or deploy it, and check the permissions of any token you give us. Deploys and self-heal act in your own accounts, so you are responsible for what runs there.

We reserve the right to refuse requests, revoke API keys, block networks or clients, and suspend or close accounts that break this policy, with or without notice.

Report abuse or a security issue via /security.

• The initial draft of this policy was prepared with the help of Google Gemini, then edited to match how devstack.bid works.

• OWASP Top 10 for LLM Applications
• RFC 9110 §10.2.3 Retry-After