Acceptable Use Policy

1. Purpose and scope

1.1 Secure Vibes helps people find and fix security weaknesses in apps they are responsible for. This policy protects the owners of the systems we scan, our users and us.

1.2 It applies to every use of Secure Vibes, including quick scans, full scans, domain verification, and every report, fix prompt and video (the "Outputs"). A breach of this policy is a material breach of the Terms of Service.

2. The core rule: authorization

2.1 What counts as ownership. You own the website and the systems it uses, or you are an employee, officer or other legal representative of the organization that does and are allowed to act for it.

2.2 What counts as authorization. Permission is valid only if it is:

1. written (for example a signed agreement, a statement of work or an email from someone with authority);
2. given by someone with authority to permit testing of that system;
3. specific enough to cover the target and the type of checks in the tier you choose (see what the Service does);
4. current, not expired or withdrawn; and
5. available to show us promptly if we ask.

2.3 Connected systems count too. A scan can reach systems the website relies on, such as its database or backend provider (for example Supabase or Firebase), API servers and AI endpoints. Your ownership or permission must cover them, and you must follow those providers' own rules on security testing.

2.4 Things that are not permission: the site being public; a domain-verification token being visible on the site; a bug bounty or vulnerability disclosure program that does not allow automated scanning or does not cover the target; permission from someone who does not control the system; or a belief that the owner "would not mind".

2.5 Your statement before each scan. Before each scan you confirm, in an exact authorization statement, that you are the owner or that you hold explicit written permission, and that you accept full responsibility for the scan. We store a record of that statement with your account details. Do not confirm it unless it is true.

3. Prohibited uses

You must not use Secure Vibes, or any Output, to:

1. scan without authorization: scan, or try to scan, any system you do not own or are not authorized in writing to test, including competitors', former employers', clients' (without a written engagement) or random third-party websites;
2. attack: exploit, attack, disrupt, overload or gain unauthorized access to any system, or use the Service as part of reconnaissance for an attack;
3. take what isn't yours: access, copy, use, test or sell any key, credential, token or data found in a scan unless it belongs to you or you are authorized to handle it (for example, to rotate it);
4. evade limits or safeguards: get around or test our rate limits, quotas, target blocks, ownership verification, sign-in or other safeguards, including by using multiple accounts, disposable or borrowed email addresses, VPNs or proxies to hide your identity, or sharing accounts;
5. automate or mass-scan: use scripts, bots or other automated means to request scans, or scan lists of targets, large numbers of domains or ranges of addresses;
6. resell: resell, sublicense, white-label or offer the Service or its Outputs as part of a product or service for third parties, or scan on behalf of clients, without our prior written agreement;
7. mislead: impersonate any person or organization, misrepresent your relationship with a target, or give a false authorization statement;
8. scan sensitive systems without authorization (see Section 4);
9. harass or extort: use Outputs to threaten, pressure, shame or extort anyone, including by demanding payment in return for not disclosing a weakness;
10. break the law: violate any applicable law, including computer misuse, data protection and export-control laws, or any third party's rights or contracts; or
11. help anyone else do any of the above.

4. Sensitive and critical systems

4.1 You must not scan any of the following without explicit, written authorization from their owner that specifically covers automated security scanning:

• critical infrastructure (for example energy, water, transport, telecommunications or emergency services);
• government, military, law-enforcement, judicial or election systems;
• healthcare systems, including hospitals, clinics, health records and medical devices;
• financial systems, including banks, payment processors, exchanges and insurers; or
• any other system whose disruption could endanger life, safety or essential services.

4.2 Even with authorization, we may block whole categories of these targets (for example all .gov domains) and refuse such scans at our discretion. If you have a legitimate need to scan a blocked target, contact us first.

5. Using results responsibly

5.1 If you come across a weakness in a system you are not responsible for, do not exploit it. Report it privately to its owner through their published security contact or disclosure program, and give them reasonable time to fix it before any public mention.

5.2 Outputs can reveal how to attack a system. Keep them confidential and share them only with people who need them to fix it. Fix prompts are suggestions, not tested fixes; see Section 7 of the Terms.

6. Fair use and limits

6.1 We apply limits per IP address and per account (for example a maximum number of quick and full scans per hour and per day). Limits may change without notice.

6.2 One person, one account. Use the Service through its normal web interface only. Do not use it in a way that degrades it for others or places an unreasonable load on targets.

7. Respecting the Service itself

7.1 You must not attack, probe, scan or load-test Secure Vibes; try to make our scanner reach private, internal or cloud-metadata addresses; use the Service as a proxy or to send traffic we did not design it to send; or access other users' reports, prompts, videos or accounts.

7.2 If you find a vulnerability in Secure Vibes, please report it through our security contact and do not access more data than needed to show the problem. We welcome good-faith reports.

8. How we enforce this policy

8.1 For every scan we keep a consent record: your account and email address, the target, the tier, your consent basis, the exact statement you confirmed (by hash and version), the Terms version, a hashed IP address, your user agent and the time. Details are in our Privacy Policy.

8.2 If we suspect a breach of this policy, we may, at our discretion and without notice or liability:

• ask you for proof of ownership or permission and pause your scans until we receive it;
• stop scans in progress, refuse future scans and block targets or domains;
• suspend or permanently close your account and ban your email address or domain, without refund where the breach is yours;
• disclose your identity and consent records to the affected owner, where the law allows; and
• report the matter to, and cooperate with, law enforcement and regulators.

8.3 Our decision not to act on a breach does not waive our right to act later. You remain responsible for any harm your scans cause, as set out in the indemnity in our Terms.

9. Reporting abuse

9.1 If your site was scanned without your permission, email [email protected] [CONTACT EMAIL] with the subject "Abuse report" and include:

• the affected domain or host;
• the approximate date and time of the requests;
• relevant log lines (our scanner identifies itself in its User-Agent with a contact URL); and
• how we can confirm you are the owner or operator.

9.2 What we do. We investigate every report. Where we find a scan was unauthorized, we act under Section 8 and, where the law allows, tell you which account requested it and share the relevant consent record so you can take further action.

9.3 Block your domain. Website owners can ask us to block their domain from all future scans by contacting us from an address at that domain or by otherwise proving control.

10. Changes and contact

10.1 This policy shares a version number with our Terms of Service and Privacy Policy. When we change it materially, we publish a new version and you will be asked to accept it before your next scan.

10.2 Questions about this policy: [email protected] [CONTACT EMAIL], [COMPANY LEGAL NAME], [REGISTERED ADDRESS].