DCP acceptable use (v0.2-draft)

Supported: static sites; Node 22 and Python 3.12 apps listening on PORT; SQLite at DATABASE_PATH; the static-site database at /_dcp/db. Outbound HTTP/HTTPS (ports 80 and 443) to the public internet.
Anything else may work but is unsupported and may change without notice.

Fair use: prefer polling (a request every few seconds) for live updates. WebSockets are for activated apps that need instant updates (games, chat, collaborative editing): 100 open connections per app, idle connections close after 5 minutes, 100 connection-hours per app per month. Apps that affect other users are asked to change, then limited.

Not allowed:
- Crypto mining or other compute resale
- Open proxies, VPNs, Tor relays, port or vulnerability scanning
- Sending email directly (SMTP ports are blocked) or any spam
- Phishing, or collecting passwords or payment details on apps that have not been claimed
- File-sharing mirrors, torrents, hosting pirated material
- Attacking or overloading other apps, the host or other networks
- Illegal content, malware, content that exploits children

Enforcement: per-app CPU (0.5 core), memory (256 MiB) and traffic limits; outbound limited to ports 80 and 443; private and internal networks blocked; packages that exist for abuse are refused at build; apps running at full CPU for long periods are paused; reports to abuse@dcpfoundation.org can lead to suspension. Suspended apps keep their files unless the content is illegal.

Security advice (warned at deploy, never blocked): use parameterised SQL; never eval request input; never build shell commands from input; keep keys in env, not in files.