Terms of Service

1. Who we are and this agreement

1.1 Secure Vibes (the "Service") is operated by [COMPANY LEGAL NAME], a company registered under number [COMPANY REGISTRATION NUMBER] with its registered office at [REGISTERED ADDRESS] ("Secure Vibes", "we", "us" or "our").

1.2 These Terms of Service (the "Terms"), our Acceptable Use Policy (the "AUP") and our Privacy Policy together form the agreement between you and us. The AUP is part of these Terms. The Privacy Policy explains how we handle personal data.

1.3 You accept these Terms when you tick the acceptance box at sign-in (or when asked to accept a new version), and again each time you confirm an authorization statement before a scan. If you do not agree, do not use the Service.

1.4 If you use the Service on behalf of a company or other organization, you confirm that you have authority to bind it, and "you" includes that organization. You and the organization are jointly responsible for compliance with these Terms.

2. Definitions

Target

The website, domain, host or application you ask us to scan, together with every system it connects to that the checks reach (for example its database or backend provider, API servers and AI endpoints).

Quick scan

The free, passive scan described in Section 4.2.

Full scan

The paid scan with additional read-only active checks described in Section 4.3, available only after ownership verification.

Authorization statement

The exact consent text you confirm before each scan, either as the owner of the Target ("owner") or as a person with explicit written permission from the owner ("authorized").

Outputs

Everything the Service produces for you: reports, scores and grades, findings, evidence, the AI-agent fix prompt, the generated video and any other content.

Fix prompt

The text the Service generates for you to give to an AI coding agent (such as Claude Code, Codex, Cursor, Lovable or Antigravity) to change your code or configuration.

3. Eligibility and your account

3.1 You must be at least 18 years old and able to form a binding contract to use the Service.

3.2 You sign in with a one-time link sent to your email address. You must use an email address you control and that genuinely identifies you or your organization. Disposable, shared or misleading addresses are not allowed, and we may reject them.

3.3 You are responsible for everything done through your account, including every scan requested and every authorization statement confirmed. Keep access to your email inbox and devices secure, do not share sign-in links or sessions, and tell us immediately at [email protected] if you think your account has been used without your permission.

3.4 You may hold one account. You must not create accounts to get around limits, suspensions or bans.

4. What the Service does

4.1 Before any scan. You must be signed in with a verified email, have accepted the current version of these Terms, the AUP and the Privacy Policy, and confirm an authorization statement for the specific Target. We record that statement with each scan (see Section 11).

4.2 Quick scan (free, passive)

A quick scan only performs requests that an ordinary visitor's browser, a mail server or a DNS resolver would make. It may check: the TLS certificate and protocol, HTTPS redirects and security headers, cookies, DNS and email records (such as SPF, DMARC, DNSSEC and CAA), domain registration data, public JavaScript files for exposed keys, public files and paths (such as /.env, /.git/HEAD and source maps), outdated client-side libraries, threat-intelligence blocklists, and subdomains listed in public certificate-transparency logs.

4.3 Full scan (paid, owner-verified)

A full scan is available only after you prove control of the domain by a meta tag, a file at /.well-known/securevibes.txt or a DNS TXT record. In addition to the quick scan, it performs read-only active checks, which may include:

• database exposure tests (for example Supabase or Firebase) using the public keys the site itself ships to every visitor. We record only table or collection names and row counts. We never store or show row contents;
• unauthenticated GET requests to API routes referenced in the site's own code;
• a cross-origin resource sharing (CORS) check;
• a plain connection test on a fixed list of 15 well-known TCP ports (nothing is sent over the connection);
• requests for a longer list of commonly exposed files and paths (such as backups, configuration files, debug pages and API schemas); and
• at most a few very small requests to AI endpoints that appear to be open, which may use a negligible number of AI tokens billed to the site owner.

4.4 What the Service never does. The Service does not write, change or delete data, attempt logins, guess passwords, brute-force, inject payloads, exploit vulnerabilities or load-test. It only scans public IP addresses and identifies itself in its requests with a contact URL.

4.5 Outputs. After a scan you receive a report, a fix prompt and, where available, a generated video. Any secrets we detect are stored and shown only in redacted form. Your Outputs are visible only to your account.

4.6 Changes and availability. The checks, limits, quotas and features may change over time. We aim to keep the Service available but do not promise it will be uninterrupted, error-free or available in every country.

5. Authorization to scan: your responsibility

5.1 Your promises. Each time you request a scan, you represent and warrant that:

1. the authorization statement you confirm is true and complete;
2. you own the Target and every system it connects to that will be checked, or you are a legal representative of its owner; or you hold explicit, written permission from the owner of the Target and of each of those systems that covers the checks described for the scan tier you choose;
3. the permission has not expired or been withdrawn, and is not limited in a way that excludes our checks (for example, a bug bounty program that forbids automated scanning does not count);
4. the scan does not breach any contract, hosting or platform terms, or law that applies to you or the Target; and
5. you will provide proof of your ownership or permission promptly when we ask.

5.2 Ownership verification is not legal permission. Our domain-verification step is a technical safeguard. Passing it does not mean we have confirmed that you are legally entitled to scan the Target or the systems it connects to (for example third-party database, hosting or API providers). That remains entirely your responsibility.

5.3 You are solely responsible. You, not Secure Vibes, are the person who decides to scan a Target and who instructs the Service to do so. You are solely responsible for every scan you request, for obtaining and keeping all necessary permissions, and for all consequences of the scan, including any claim by the owner or operator of the Target or of any connected system.

5.4 Unauthorized scanning may be illegal. Accessing or testing computer systems without permission may be a crime and may give rise to civil claims in many countries. We may report suspected unauthorized scanning to the affected owner and to the authorities (see Section 11).

6. Effects of a scan on the target

6.1 Although our checks are designed to be read-only and light, any scan sends network traffic to the Target. You understand and accept that a scan may, among other things:

• appear in the Target's logs or trigger security alerts, firewall rules, rate limits or automated blocking of our scanner;
• generate notifications to the Target's hosting, database or security providers;
• consume a small amount of bandwidth, compute or request quotas; and
• during a full scan, use a negligible number of AI tokens on an open AI endpoint, billed to the site owner.

6.2 It is your responsibility to coordinate with the Target's owner, hosting provider and any other affected party before scanning where that is required or prudent. To the fullest extent permitted by law, we are not responsible for these effects or for any action a third party takes in response to a scan.

7. Reports, AI fix prompts and videos

7.1 Outputs are partly generated by automated systems and AI. Findings are produced by automated checks and automated classification, and parts of the text, fix prompt and video script may be written or refined by AI models. Outputs can be incomplete, out of date or wrong, including false positives and false negatives.

7.2 Before you act on any Output you must:

1. make and verify a complete backup of your code, configuration and data;
2. read the fix prompt and understand what it asks your agent to do;
3. review every change your agent proposes or makes, ideally in a separate branch or test environment, before deploying it;
4. test your application after the change, including access rules and any data migrations; and
5. carry out the steps only a human can do (such as rotating leaked keys) yourself, directly with the relevant provider.

7.3 We are not responsible for any loss of data, downtime, broken functionality, security weakness, cost or other harm caused by changes you or your AI agent make, whether or not based on an Output.

7.4 Sharing Outputs. Outputs can reveal security weaknesses. If you download, share or publish an Output (including the video), you do so at your own risk and you are responsible for protecting it.

8. Acceptable use

8.1 You must comply with our Acceptable Use Policy, which forms part of these Terms. In summary, you must not:

• scan, or attempt to scan, any system you do not own or are not authorized in writing to test;
• use the Service or any Output to attack, exploit, disrupt or gain unauthorized access to any system, or to access, copy or use data or keys that are not yours;
• scan critical infrastructure, government, military, healthcare or financial systems without explicit written authorization from their owner;
• evade or test our limits, quotas, blocks or safeguards, use multiple accounts, or run automated or mass scanning;
• resell, sublicense or offer the Service or Outputs as part of your own service without our written agreement; or
• attack, probe or misuse the Service itself.

8.2 A breach of the AUP is a material breach of these Terms.

9. Payments and refunds

9.1 Price. The quick scan is free. A full scan costs a one-time fee for each full scan of a verified domain. The price, currency and any taxes are shown before you pay. There is no subscription and no automatic renewal.

9.2 Payment processing. Payments are processed by Nomod. We do not receive or store your card details. Nomod's own terms and privacy policy apply to your payment.

9.3 What a payment covers. One payment unlocks one full scan of the verified domain for your account. It cannot be transferred to another account or domain.

9.4 Refunds. Refunds are at our discretion. Because a full scan is a digital service performed immediately on your request:

• no refund is due once the full scan has run, unless the scan failed to complete because of a problem on our side, in which case we will, at our choice, let you run it again or refund the fee;
• a refund is not due because a scan found few or no issues, because the Target blocked our scanner, or because you disagree with a finding; and
• if you paid but have not yet run the full scan, contact us and we will normally consider a refund.

9.5 Consumers. If you are a consumer with a statutory right to withdraw from a digital-services contract, you expressly request that we start the full scan immediately, and you acknowledge that you lose your right of withdrawal once the scan has been fully performed. Nothing in these Terms removes any other mandatory consumer right you have.

9.6 Chargebacks and misuse. If you dispute a valid charge or we refund a payment because of fraud or a breach of these Terms, we may suspend your account and block the related Targets.

10. Suspension, refusal and blocking

10.1 To protect the Service, third parties and the public, we may at any time, with or without notice, and without liability to you:

• refuse, delay, limit or stop any scan, including a scan already in progress;
• block specific Targets, domains, categories of domains (for example government domains) or networks from being scanned;
• apply, change and enforce rate limits and daily quotas;
• reject email addresses or domains, and require proof of ownership or permission before a scan; and
• suspend or terminate your account and your access to Outputs.

10.2 We will normally use these rights where we reasonably suspect a breach of these Terms or the AUP, receive an abuse report, are required by law, or need to protect the security or integrity of the Service. If we suspend a paid account without a breach on your part, we will refund any full scan you paid for but have not run.

11. Records, abuse reports and law enforcement

11.1 Audit trail. For every scan we keep a consent record containing: your account identifier and email address, the Target host, the scan tier, your consent basis (owner or authorized), a cryptographic hash and version of the exact authorization statement you confirmed, the version of these Terms you accepted, a hashed form of your IP address, your browser's user agent and the time. We also keep records of your acceptance of these Terms. You agree that these records are accurate evidence of what you confirmed, and we retain them as described in our Privacy Policy.

11.2 Abuse reports. If the owner or operator of a system reports that it was scanned without permission, we will investigate. Where the law allows, we may disclose to them the identity of the requesting account (including its email address), the relevant consent records, and the scans performed, so that they can protect their rights.

11.3 Law enforcement. We cooperate with law enforcement and regulators. We may disclose account information, consent records, scan records and other data we hold in response to valid legal process, or where we believe in good faith that disclosure is necessary to prevent harm, investigate unlawful activity or protect our rights or the rights of others.

12. Intellectual property and use of reports

12.1 Ours. We and our licensors own the Service, including its software, checks, finding catalog, templates, design, video templates and branding. Except for the rights expressly granted in these Terms, no rights are transferred to you.

12.2 Your licence to Outputs. Subject to these Terms, we grant you a non-exclusive, non-transferable, worldwide licence to use, copy and share the Outputs of your scans to assess and improve the security of the Targets you are authorized to test, including with your team, contractors, the Target's owner and your AI coding agent.

12.3 Restrictions. You must not: use Outputs about a system you are not authorized to test; publish or disclose a third party's vulnerabilities except through responsible, coordinated disclosure with that party; sell or redistribute Outputs as a product or service; or copy, reverse-engineer, scrape or build a competing service from the Service, except as the law expressly permits.

12.4 Your content. You keep any rights you have in the Target and its content. You grant us the rights we need to perform the scans you request and to produce, store and display Outputs to you. We may create aggregated, de-identified statistics from scans (for example, how often a type of issue appears) that do not identify you or any Target, and use them to improve and describe the Service.

12.5 Feedback. If you send us suggestions or feedback, we may use them without obligation to you.

13. Third-party services

13.1 The Service relies on third-party providers for hosting, email, payments, AI processing, text-to-speech and public data sources, listed in our Privacy Policy. Their availability and accuracy are outside our control.

13.2 Your Target may run on third-party platforms (for example Supabase, Firebase, Vercel or Lovable). You are responsible for complying with those platforms' terms, including any rules about security testing. We are not affiliated with or endorsed by those platforms, and references to them are for identification only.

14. No legal or compliance advice

The Service and its Outputs are technical information only. They are not legal, regulatory, compliance, audit or professional security advice, and they are not a penetration test, certification or attestation. A good score or grade does not mean your application is secure or compliant with any law or standard (such as data-protection law, PCI DSS, SOC 2 or ISO 27001). Do not rely on the Service as a substitute for advice from qualified professionals.

15. No warranty

15.1 In particular, and to the fullest extent permitted by law, we disclaim all implied warranties and conditions of merchantability, satisfactory quality, fitness for a particular purpose, accuracy, non-infringement and uninterrupted or error-free operation.

15.2 We do not warrant that the Service will find all, or any particular, vulnerabilities; that any finding is accurate or complete; that any fix, fix prompt or change made by you or your AI agent is correct, complete or safe; or that your application will be secure after following any Output.

15.3 Some jurisdictions do not allow certain warranties to be excluded. In that case, those warranties apply only to the minimum extent required by law.

16. Limitation of liability

16.1 Excluded losses. To the fullest extent permitted by law, neither Secure Vibes nor its affiliates, officers, directors, employees, contractors or suppliers will be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, business, goodwill or anticipated savings, loss or corruption of data, security incidents, business interruption, or cost of substitute services, however caused and on any theory of liability, even if we were told such damages were possible.

16.2 Cap. To the fullest extent permitted by law, our total aggregate liability arising out of or relating to the Service, the Outputs or these Terms is limited to the total fees you paid us for the Service in the twelve (12) months before the event giving rise to the claim.

16.3 What we do not limit. Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be excluded or limited under applicable law, including mandatory consumer rights.

16.4 These limits reflect the allocation of risk between you and us, are a fundamental basis of our pricing, and apply even if a limited remedy fails of its essential purpose.

17. Your indemnity

17.1 To the fullest extent permitted by law, you will defend, indemnify and hold harmless Secure Vibes and its affiliates, officers, directors, employees, contractors and agents from and against all claims, demands, proceedings, investigations, losses, damages, liabilities, fines, penalties, costs and expenses (including reasonable legal fees) arising out of or relating to:

1. any scan requested through your account;
2. any authorization statement that was false, incomplete or not backed by valid permission;
3. your breach of these Terms or the AUP, or your violation of any law or third-party right;
4. your use of any Output, including any change made by you or your AI agent based on a fix prompt; or
5. any claim by the owner or operator of a Target or connected system relating to a scan you requested.

17.2 We will tell you about a claim we seek indemnity for, may control its defence with counsel of our choice, and you will cooperate with us. You must not settle any claim that affects us without our prior written consent.

18. Ending this agreement

18.1 You may stop using the Service at any time and ask us to close your account by contacting us.

18.2 We may suspend or terminate your account under Section 10, or end the Service as a whole on reasonable notice.

18.3 When your account ends, your right to use the Service ends. We keep and delete data as described in our Privacy Policy; consent and audit records are kept for their full retention period even after your account is closed.

18.4 Sections 5, 7, 11, 12, 14 to 17, 20 and 21, and any other terms that by their nature should survive, survive termination.

19. Changes to the Service and these Terms

19.1 These Terms, the AUP and the Privacy Policy share a version number, shown at the top of each document. When we change any of them materially, we publish a new version with a new version number and effective date.

19.2 After a material change, you will be asked to accept the new version before your next scan. If you do not accept it, you may not request further scans, and you may close your account. Changes do not apply retroactively to scans run before the change.

19.3 We may make non-material changes (such as clarifications or corrections) without asking you to re-accept.

20. Governing law and disputes

20.1 These Terms, and any dispute or claim arising out of or in connection with them or the Service (including non-contractual disputes), are governed by the laws of [GOVERNING LAW / JURISDICTION], without regard to its conflict-of-law rules.

20.2 Before starting any formal proceedings, please contact us and give us 30 days to try to resolve the dispute informally.

20.3 Subject to Section 20.4, the courts of [GOVERNING LAW / JURISDICTION] have exclusive jurisdiction over any such dispute. To the extent permitted by law, disputes will be brought on an individual basis and not as a class or representative action.

20.4 If you are a consumer, you keep the protection of any mandatory provisions of the law of the country where you live, and you may bring proceedings in the courts of that country where the law allows. We may seek urgent injunctive or equivalent relief in any competent court to stop unlawful scanning or misuse of the Service.

21. General terms

21.1 Entire agreement. These Terms, the AUP and the Privacy Policy are the entire agreement between you and us about the Service and replace any earlier agreement or understanding about it.

21.2 Severability. If any provision is found invalid or unenforceable, it will be modified to the minimum extent needed to make it enforceable, and the remaining provisions stay in full force.

21.3 No waiver. If we do not enforce a right, we have not waived it.

21.4 Assignment. You may not transfer your rights or obligations under these Terms without our written consent. We may transfer ours to an affiliate or in connection with a merger, acquisition or sale of assets.

21.5 Events outside our control. We are not responsible for delays or failures caused by events beyond our reasonable control, including failures of third-party providers, networks or the Target.

21.6 Notices. We may send notices to the email address on your account or show them in the Service. You can send notices to us at the contact details below.

21.7 Language. These Terms are written in English. If we provide a translation, the English version prevails to the extent permitted by law.

21.8 No third-party rights. Except for the persons protected by Sections 16 and 17, nobody other than you and us has any right to enforce these Terms.

22. Contact

[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
Company registration number: [COMPANY REGISTRATION NUMBER]
Email: [email protected] [CONTACT EMAIL]

To report a scan of your systems you did not authorize, see how to report abuse. To report a security vulnerability in Secure Vibes itself, see our security contact.