Security researchers must follow X's Vulnerability Reporting Program rules
If you are a security researcher, you must comply with the rules of X's Vulnerability Reporting Program. The developer-use requirements described just before may not apply to people participating in that program.
Supporting quotations
If you are a security researcher, you are required to comply with the rules of our
The requirements set out in the preceding paragraph may not apply to those participating in our Vulnerability Reporting Program.
Qualifications & exceptions
The developer-use requirements may not apply to program participants.
Not stated here
The program rules are hosted elsewhere and are not supplied.
Security & Safeguards · Restriction or exception
You must secure your account, and X is not liable for losses from failing to do so
You may need an account to use the Services. You are responsible for safeguarding it: use a strong password used only for this account, and use two-factor authentication through an authenticator app or security key. X says it cannot and will not be liable for any loss or damage arising from your failure to do these things.
Supporting quotations
You are responsible for safeguarding your account, so use a strong password and limit its use to this account, and use two-factor authentication via an authenticator app or security key.
We cannot and will not be liable for any loss or damage arising from your failure to comply with the above.
Security & Safeguards · Restriction or exception
Probing systems, jailbreaking or prompt injection, forging headers and flooding are banned
While using the Services you may not access or tamper with non-public areas or systems; probe, scan or test vulnerabilities or bypass security or authentication; try to circumvent, manipulate or disable systems, including through jailbreaking, prompt engineering or injection, or other ways of overriding safety or security controls; forge TCP/IP packet or header information; send altered, deceptive or false source-identifying information; or interfere with or disrupt any user, host or network, for example with viruses, flooding, spamming, mail-bombing or scripted Content creation that burdens the Services.
Supporting quotations
(i) access, tamper with, or use non-public areas of the Services, our computer systems, or the technical delivery systems of our providers; (ii) probe, scan, or test the vulnerability of any system or network or breach or circumvent any security or authentication measures;
(iv) attempt to circumvent, manipulate, or disable systems and Services, including through "jailbreaking", “prompt engineering or injection", or other methods intended to override or manipulate safety, security or other platform controls; (v) forge any TCP/IP packet header or any part of the header information in any email or posting; (vi) in any way use the Services to send altered, deceptive or false source-identifying information;
(viii) interfere with, or disrupt, (or attempt to do so), the access of any user, host or network
Security & Safeguards · Restriction or exception
EU, EFTA and UK version: secure your account; X is not liable if you do not
In the EU, EFTA and UK version, you are likewise responsible for safeguarding your account with a strong password used only for this account and two-factor authentication through an authenticator app or security key, and X says it cannot and will not be liable for loss or damage from your failure to do so.
Supporting quotations
You are responsible for safeguarding your account, so use a strong password and limit its use to this account, and use two-factor authentication via an authenticator app or security key.
We cannot and will not be liable for any loss or damage arising from your failure to comply with the above.
Security & Safeguards · Restriction or exception
EU, EFTA and UK version: no interference, reverse engineering, system probing or jailbreaking
In the EU, EFTA and UK version, the same misuse rules apply: no interfering with the Services, working around technical limits or reverse engineering X's software (except to the extent law expressly permits), accessing non-public systems, probing vulnerabilities or bypassing security, circumventing safety or security controls through jailbreaking or prompt engineering or injection, forging headers, sending deceptive source information, or disrupting users, hosts or networks.
Supporting quotations
You agree that you will not work around any technical limitations in the software provided to you as part of the Services, or reverse engineer, decompile or disassemble the software, except and only to the extent that applicable law expressly permits.
(ii) probe, scan, or test the vulnerability of any system or network or breach or circumvent any security or authentication measures;
(iv) attempt to circumvent, manipulate, or disable systems and Services, including through "jailbreaking", “prompt engineering or injection", or other methods intended to override or manipulate safety, security or other platform controls;
Qualifications & exceptions
Reverse engineering is allowed only to the extent applicable law expressly permits.