1. Purpose and scope
This policy applies to your use of BHIM websites and services and, subject to the applicable licence, BHIM security software. Use these resources lawfully and in a way that respects the security, privacy, and availability of other systems.
2. Authorised systems only
Install, configure, and test security tools only on systems you own or are expressly authorised to administer. Obtain permission covering the target, methods, timing, and traffic volume before conducting security testing. Access to public software is not permission to test someone else’s infrastructure.
3. Prohibited activities
Do not use BHIM resources to gain unauthorised access, steal credentials, deploy malware, exfiltrate data, evade lawful access controls, run phishing campaigns, or facilitate fraud. Do not impersonate BHIM, distribute deceptive installers, or misrepresent the source or safety of modified software.
4. Availability and abuse
Do not flood, overload, disrupt, or conduct denial-of-service attacks against BHIM or third-party systems. DoS protection and WAF functionality are defensive capabilities, not permission to generate attack traffic. Use isolated environments for load and attack simulations unless the target operator has explicitly agreed otherwise.
5. Privacy and sensitive information
Do not collect, disclose, or distribute personal information without a lawful basis. Protect logs and incident records against unauthorised access. Do not publish credentials, private keys, session tokens, or customer data in support requests or vulnerability reports.
6. Safe operation
Review allowlists, rate limits, block rules, and server configuration before production deployment. Keep a recovery path for administrative access, test changes, and monitor false positives. Do not rely on a security product as the sole control for a critical system.
7. Reports and enforcement
Report suspected abuse to team@bhim.si with relevant timestamps, affected URLs, and a brief description. Where necessary and legally permitted, BHIM may restrict access to resources it controls, investigate abuse, or respond to lawful requests. This does not imply remote access to or control of your self-managed installation.
8. Security research and changes
Follow the Security Policy when reporting vulnerabilities. This policy does not authorise intrusive testing of BHIM or third-party systems. We may update these rules as threats and services evolve; applicable licences and mandatory legal rights remain relevant.