Authorized Testing Policy

Version 2026-10

1. Purpose

This policy defines the conditions for using the platform to assess the security of websites and web applications. The platform is intended for authorized defensive assessment only.

2. Ownership and authorization

An asset may only be added for assessment if your organization owns it or holds explicit written authorization from its owner. The user bears full legal responsibility for the accuracy of this declaration.

3. Proof of ownership

The platform requires proof of control over the domain via a DNS TXT record or an HTTP verification file before any active assessment. Verification tokens expire, and verification is repeated when ownership changes or authorization lapses.

4. Approved scope

Assessments run only against approved domains, paths, ports and profiles, within the defined request budgets and time windows. Any out-of-scope target, or one resolving to internal or reserved addresses, is rejected.

5. Nature of checks

Default checks are passive or low-impact. The platform performs no destructive tests, password guessing, authentication bypass, exploitation or modification of customer data. Optional active checks require separate explicit approval.

6. Limits of results

The absence of findings does not mean an asset is free of vulnerabilities. Results carry stated confidence levels and distinguish confirmed, potential and unverified issues.

7. Logging and privacy

Declarations, scope approvals and sensitive operations are recorded in a tamper-evident audit log. Secrets, cookies and tokens are redacted from evidence and logs.

8. Abuse

The platform operator may immediately suspend any account or assessment suspected of abuse and cooperate with competent authorities as required by law.