Acceptable Use Policy

Guidelines and prohibitions to safeguard our edge infrastructure and ensure fair, reliable service for all developers.

Draft Policy — Requires Legal Review Before Launch

This document outlines the operational and security rules enforced across the GenerativeOG platform operated by GenerativeOG. Requires legal review before commercial release.

1. Purpose & Core Philosophy

GenerativeOG is designed as an open, accessible service for developers, creators, and organizations to generate high-quality Open Graph images. To maintain service reliability and protect downstream users, all traffic to our edge endpoints and developer tools must comply with this Acceptable Use Policy.

2. Prohibited Content

You may not use the image generation API to render, display, or distribute:

  • Unlawful or Infringing Material: Content that violates intellectual property rights, copyrights, trademarks, or applicable local or international laws.
  • Deceptive & Phishing Imagery: Cards crafted to deceive users, impersonate institutions or individuals, or facilitate credential harvesting.
  • Harassment, Hate Speech & Violence: Imagery promoting hate speech, violence, harassment, discrimination, or non-consensual personal imagery.
  • Malware & Exploits: URLs designed to trigger browser exploits or distribute malicious binaries.

3. Prohibited Infrastructure & Security Attacks

You may not use the service or its diagnostic tools to conduct or attempt:

  • Server-Side Request Forgery (SSRF) Probing: Submitting remote asset URLs (logo or avatar) targeting internal networks, RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1), link-local (169.254.0.0/16), cloud metadata services, or non-standard ports. Our edge workers run active validation to fail-closed on SSRF attempts.
  • Rate Limit Circumvention: Rotating proxies, forging IP headers, or manipulating request patterns to evade the 60 req/min burst or 1,000 req/day quota.
  • Automated Flooding of Developer Tools: Using automated bots or high-concurrency scripts to scrape or flood the Open Graph Metadata Inspector or Image URL Inspector.
  • Denial-of-Service (DoS) Attacks: Flooding endpoints with oversized payloads, malformed URL structures, or synthetic traffic designed to degrade edge availability.

4. Remote Asset Fetching Rules

When providing remote image URLs via query parameters:

  • URLs must use the public https:// scheme.
  • The remote server must respond within 5 seconds.
  • The remote asset payload must not exceed 2 MB.
  • Content must be a valid raster image (PNG, JPEG, WebP) or safe SVG image.

5. Enforcement & Remediation

When violations or automated attack signatures are detected:

  • Immediate Rejection: Requests violating size, schema, or SSRF rules are rejected immediately with HTTP 400, 403, 422, or 429.
  • Edge Firewall Blocking: IP hashes or networks exhibiting persistent abusive patterns may be blocked at Cloudflare edge firewalls.
  • No Notice Requirement: While we endeavor to communicate when possible, we reserve the right to block malicious traffic without prior notification.

6. Reporting Violations

If you encounter abusive content generated through our platform or identify a security vulnerability, please report it immediately to [email protected].