Terms of Service

You must be legally capable of entering into a binding agreement. If you use the Services for an organization, you represent that you have authority to bind that organization.

If you do not agree to these Terms, do not access the Services or submit a target.

SafeForProd may provide a free passive scan, an authorized source scan, human security review, reports, and related advisory work. The scope, access, and testing depth differ between services.

The free passive scan retrieves only the submitted page, directly referenced or advertised public assets, headers, and ordinary browser-visible activity. It does not authorize exploitation, use of discovered credentials, data mutation, hidden-path probing, or active access-control testing.

Source analysis and active runtime validation require the additional account, authorization, source-intake, domain-verification, and written scope controls shown during the engagement.

A signed order, statement of work, or engagement letter may add service-specific terms. If it conflicts with these Terms, the signed engagement document controls for that engagement.

For every submitted target, you represent and warrant that:

• You own or control the target, or have express authorization from a person with authority to permit the requested testing.
• Your authorization covers the relevant domains, subdomains, infrastructure, repositories, accounts, test data, third-party integrations, and requested testing methods.
• The scan does not violate any law, court order, acceptable-use policy, hosting agreement, employment duty, confidentiality obligation, or third-party right.
• Any test account, source code, personal data, credential, or other material you provide may lawfully be provided and processed for the engagement.

You—not SafeForProd—are responsible for confirming that your authorization is sufficient. SafeForProd may request proof of authorization, reject a target, narrow the scope, or stop a scan at any time.

SafeForProd relies on your representations when accepting a scan. SafeForProd is not responsible for claims, losses, service interruptions, or legal consequences arising from your lack of authority, inaccurate instructions, or unlawful submission.

You must not use the Services to:

• Scan or access a target without sufficient authorization.
• Harass, monitor, disrupt, degrade, overload, extort, or cause harm to another person or system.
• Evade rate limits, bot protection, scope controls, domain verification, access restrictions, or safety mechanisms.
• Use findings, reports, credentials, or data for exploitation, surveillance, credential theft, unauthorized disclosure, or any unlawful purpose.
• Submit malware, destructive payloads, unlawful content, or material that infringes another person’s rights.
• Misrepresent a SafeForProd report as a certification, guarantee, compliance approval, or authorization to attack a target.

You are responsible for accurate submission information, protecting account credentials and report links, and promptly notifying SafeForProd of suspected unauthorized access.

You retain ownership of source code and other materials you provide. You grant only the limited rights necessary to provide the Services. You must not provide materials you do not have the right to submit.

Reports are provided to the email or account you specify. You are responsible for providing the correct recipient and controlling subsequent distribution. Reports may contain sensitive security information and should be handled accordingly.

Security testing is inherently incomplete. A report describes findings and observations within the stated target, version, access, time, and methods. It may contain false positives, false negatives, or issues that become outdated after a deployment or configuration change.

The Services do not guarantee that an application is secure, vulnerability-free, available, compliant, suitable for production, or protected from an attack. “Not tested” does not mean “passed.”

Reports are security assessments, not legal, regulatory, insurance, accounting, or formal compliance advice. You are responsible for remediation decisions, backups, change testing, and obtaining any specialist advice you require.

To the maximum extent permitted by law, SafeForProd and its owners, personnel, contractors, and providers will not be liable for indirect, incidental, special, exemplary, punitive, or consequential damages; lost profits, revenue, goodwill, data, or business opportunity; remediation costs; service interruption; or third-party claims arising from or related to the Services.

To the maximum extent permitted by law, SafeForProd’s total aggregate liability arising from or related to the Services will not exceed the amount you paid SafeForProd for the Service giving rise to the claim during the twelve months before the event giving rise to liability.

These limitations apply regardless of the legal theory and even if SafeForProd was advised that damage was possible. They do not exclude liability that applicable law does not allow to be excluded or limited.

SafeForProd may update these Terms as the Services change. The updated version will be posted here with a new effective date. Material changes may be communicated through the website, account, or email where appropriate.

Questions about these Terms may be sent to hello@safeforprod.com.