Abuse policy

Sapper exists so developers can show a local service to others. It is not for phishing, malware, or harassment. This policy describes what is not allowed and what happens when it is violated.

Not allowed

• Phishing: pages that imitate a bank, email provider, login portal, or any other real service to collect credentials or payment details.
• Malware: hosting, downloading, or distributing malicious software, or command-and-control for malware.
• Impersonation: pretending to be a person, company, or project you are not.
• Spam: unsolicited bulk messages, or pages built to spread them.
• Illegal content: anything that is illegal to host where we or you operate. Child sexual abuse material is reported to the appropriate authorities immediately.
• Harassment and threats directed at any person.
• Infringement: serving content you do not have the right to distribute, when a valid takedown notice is received.
• Resource abuse: using tunnels as a relay, proxy, or for denial-of-service traffic.

Enforcement

We may suspend a tunnel, a subdomain, or a key without notice when we see a violation, a valid complaint, or an automated scan flag. Keys that repeatedly violate this policy may be blocked from the service.

We may also keep a tunnel's logs needed to respond to a legal request or abuse report, and we will not publish them.

Report abuse

Email support@sapper.sh. Include the sapper.sh address, the time you saw it, and what the problem is. Reports are read by a person. We aim to respond within 72 hours.

Your responsibilities

You are responsible for what you expose through your tunnel. Keep your local service patched and do not expose anything you would not want the public to reach.