The rules for using pressure.

pressure. ("the service") is a hosted tool that sends controlled, randomized HTTP requests to a list of endpoints you configure, so you can observe how those endpoints behave under load — latency, error rates and throughput. Requests are sent server-side and are client-driven: traffic runs only while your panel tab is open in a browser and stops as soon as you close it.

You may use pressure. only to generate traffic against infrastructure that you own, operate, or have explicit, documented authorization to test. Typical legitimate uses include load testing, stress testing, capacity planning, and exercising your own staging or production systems.

You must not use pressure. to:

• Send traffic to any system you do not own or control without explicit authorization from the party that does.
• Disrupt, degrade, overload, or deny service to any third party, including any form of denial-of-service or distributed denial-of-service activity.
• Harass, harm, defraud, or interfere with any person, service, or network.
• Circumvent authentication, access controls, rate limits, or other protections of any system.
• Disguise, anonymize, or misattribute the origin of malicious or abusive traffic.
• Violate any applicable law or regulation, or the terms of service of any system you direct traffic at.

Authorization is your responsibility. If you cannot demonstrate that you are permitted to test a given endpoint, do not point pressure. at it.

To keep the service from being used for abuse, pressure. enforces several controls. These reduce abuse but do not replace your obligation to use the service lawfully and with authorization:

• Authentication required. Access is gated behind Google sign-in; there is no anonymous use.
• Per-account isolation. Each account sees and manages only its own targets; no cross-account access is possible.
• Attribution on every request. Every outbound request carries an X-Pressure-Operator header with the signed-in account's email, stamped server-side and impossible to override.
• Egress filtering. Target hostnames are resolved before each request; private, loopback, link-local and cloud-metadata address ranges are blocked.
• Rate limiting. Requests are capped at 300 per minute per account; excess requests are rejected and the panel stops.
• Client-driven. Traffic runs only while your panel tab is open and stops the moment you close it.

You are solely responsible for the targets you configure, the traffic you generate, and for ensuring you are authorized to test those targets. You agree to indemnify and hold harmless the operator of pressure. from any claim arising out of your use of the service. The operator may suspend or terminate access, with or without notice, for any use that violates these terms.

Sign-in is handled through Google OAuth. Your target configuration is stored in a hosted database and is private to your account. Closing your panel stops traffic but does not delete your stored targets.

The service is provided "as is" and "as available", without warranties of any kind, express or implied. To the maximum extent permitted by law, the operator is not liable for any damages arising from your use of, or inability to use, the service.

These terms may be updated from time to time. Continued use of the service after a change constitutes acceptance of the updated terms. Questions about these terms or reports of abuse can be sent to mwadon@gmail.com.