Acceptable use policy

Sending spam, unsolicited bulk messages, or traffic to mail submission ports. Ports 25, 465 and 587 are blocked outright.

Credential stuffing, password spraying, brute-force attempts, scraping that violates a target site’s terms, or any form of attack against a third-party system.

Reaching private, loopback, link-local, multicast or cloud-metadata addresses. These ranges are blocked automatically on IPv4 and IPv6, and resolution failures fail closed.

Distributing malware, phishing content, or content that is illegal in your jurisdiction or ours.

Circumventing the metering, rate limits, size caps, or the requirement to authenticate with a key.

Only http and https targets are permitted, credentials in the target URL are refused, and redirects are never followed — a 3xx response is returned to you instead.

Hop-by-hop headers are stripped and header names or values containing CR or LF are rejected, so a client cannot smuggle a second request upstream.

Request and response bodies are capped per call, upstream calls at 30 seconds, and every path and host is normalised before use.

Six hundred forwards per minute per key and one thousand two hundred per minute per account. Exceeding either returns HTTP 429 with a retry hint and costs no trips.

Sustained traffic well above these limits is a signal to email backfireapi@outlook.com about capacity, not to add more keys.

We may revoke individual keys immediately, and freeze an account where traffic threatens the platform or a third party.

Frozen accounts cannot forward. Trip balances remain attached to the account but are not refundable where the freeze results from a breach of this policy.

If you believe Backfire is being used to attack a system you operate, email backfireapi@outlook.com with the timestamp, target host and any request identifiers you observed. We keep metadata sufficient to investigate without retaining bodies.