Scan Authorization Agreement

This Agreement is between you (the "Owner", meaning the website owner or a person authorized by the owner) and [COMPANY LEGAL NAME / ADDRESS] ("HackGrade"). It forms part of our Terms of Service. You accept it by ticking the two boxes on the authorization screen of a verified site. The exact text you saw, its version, the date and time, your IP address and your browser are recorded as proof.

Deep scans send real test requests to your website. Doing that without permission could be unlawful under laws such as Israel's Computers Law 1995, the US Computer Fraud and Abuse Act and the UK Computer Misuse Act 1990. This Agreement is the written permission that makes the testing lawful, and it sets the limits we must stay within.

1. Your statements

By accepting, you confirm that:

• you own the website at the verified domain, or the owner has authorized you in writing to have it security-tested by a service such as HackGrade, and you have the authority to accept this Agreement for the owner;
• no hosting contract, platform policy or other agreement that you are aware of forbids this testing, or you have obtained any approval it requires (some hosting and cloud providers ask to be told in advance);
• any test account you give us belongs to the site, is meant for testing, has no administrator rights unless you intend it to, and does not hold real customers' data;
• you will tell us at once, and withdraw this authorization, if any of this stops being true.

2. Scope

• Only the verified host. We test only the exact host name you verified (for example www.example.com), on standard web ports and the 100 most common TCP ports of its IP address. Other subdomains, third-party services your site loads (payment pages, CDNs, analytics, chat widgets) and other sites on the same server are not tested. Subdomains found in public certificate logs are listed in the report but not scanned.
• Identifiable traffic. All traffic comes from our published IP address 185.202.223.42 with the user agent "HackGradeBot".
• Limited speed and time. At most 5 web requests per second, 10 port probes per second and 25 minutes per scan, with a capped total number of requests.
• Re-checked ownership. Before every scan we check again that your verification is still in place. If it is not, the scan does not run.

3. What we test

a) Passive and configuration checks (every deep scan): TLS/SSL configuration; security headers and cookies; known exposures and misconfigurations using curated, non-intrusive detection templates; sensitive files left online (such as .env, .git, backups and debug pages); exposed admin and login pages; open TCP ports (connection check only); a short crawl with passive analysis; and WordPress checks such as plugin versions, XML-RPC and user listing.

b) Safe active tests (every deep scan): we send harmless, uniquely marked test inputs to forms and parameters to detect common weaknesses: SQL and NoSQL injection (error-based and true/false comparisons only), reflected cross-site scripting (an inert marker), template injection (simple arithmetic only), open redirects, header and host-header injection, path traversal (looking only for the signature of a standard system file, without keeping its contents), access-control and IDOR checks by changing record numbers, CORS, CSRF, clickjacking, exposed API documentation, GraphQL introspection, signs of server-side request forgery, request-smuggling detection by timing on a single connection, and up to 3 sign-in attempts with made-up credentials to check rate-limiting and account enumeration.

c) Authenticated tests (Pro plans, only if you provide a test account): we sign in with your test account and repeat the safe checks on pages behind the login, compare what the account can see with what it should see (access control and privilege checks), check session handling and sign-out, and may put a harmless marker value into a field of the test account's own profile, which we then restore.

d) Cart and checkout logic (Pro plans): we add products to a cart in our own session, try to change prices, quantities, coupons or totals, read back what the server calculates, and then empty the cart. We stop before the payment or "place order" step.

e) Card-skimming detection (Pro plans): we inventory the scripts loaded on your checkout and payment pages and flag unknown or changed third-party domains, missing integrity checks and scripts that send data to foreign hosts. This is read-only; we never run or modify your scripts.

4. What we will never do

• No denial-of-service, flooding, load or stress testing.
• No password guessing or brute force beyond the 3 sign-in attempts above, and never against real users' accounts.
• No real payments and no completed orders: we never press "pay", "confirm" or "place order".
• No collecting of data beyond the minimum proof that a weakness exists. Proof excerpts are short and we redact secrets and personal data we notice. We do not download databases, customer records or files.
• No permanent changes: we do not delete or overwrite content, upload files, create accounts, post comments, change passwords, emails or addresses, or send emails from your site.
• No testing of any host other than the verified one, and no social engineering of your staff or users.
• No use of findings for any purpose other than reporting to you.

5. Possible side effects

Even careful testing is visible. You may notice:

• entries in your server, firewall and security logs, and alerts from a web application firewall, intrusion detection or your hosting provider (which may block our IP);
• error messages or error notification emails generated by test inputs;
• abandoned carts, temporary sessions and test activity in your analytics or e-commerce dashboard;
• activity on the test account you provided, such as new sessions or sign-in notifications;
• a short, small increase in load while the scan runs.

We recommend that you keep a current backup, tell anyone who monitors your site, and use a staging copy for testing if you have one. If something unexpected happens, tell us at [SECURITY/PRIVACY EMAIL] and we will stop scans at once.

6. When scans run, and how to withdraw

• This authorization lasts 90 days and covers the deep scans you start and the scheduled scans your plan includes (weekly or monthly) during that period. After 90 days, or when we change this text, we ask you again.
• You can withdraw at any time by turning off scheduled scans, deleting the site from your dashboard, deleting your account or writing to us. No new scan starts after that, and we stop any running scan as soon as practicable.
• Withdrawal does not affect scans already carried out under a valid authorization.

7. Our commitments

We will stay within this scope, keep scan results confidential and available only to your account (and to people you share them with), protect any test credentials as described in our Privacy Policy, and stop testing promptly if you or your hosting provider ask.

8. Responsibility

You are responsible for the truth of your statements in Section 1. If they are untrue and a third party (for example the real owner or a hosting provider) makes a claim against HackGrade because of a scan you requested, you will cover HackGrade's reasonable costs and losses from that claim, except to the extent caused by HackGrade going beyond this Agreement or by our negligence. Our liability to you is subject to the limits in the Terms of Service.

9. Higher-tier tests (not active)

The following tests are not offered and are switched off in our system. They would need a separate, explicitly accepted agreement with its own version number and checkbox, and they will be enabled only after legal review:

• writing a test marker that stays visible to other people (for example a comment or review) and reading it back;
• password-policy and lockout testing with more than 3 sign-in attempts;
• completing a payment flow with a test card in a sandbox you designate;
• template-injection or file-read tests beyond the harmless signatures above;
• blind command-injection timing tests;
• uploading a harmless marker file;
• creating a throwaway account to test registration controls;
• exploit-verification of specific known vulnerabilities;
• triggering a password-reset email to an address we control.

Accepting this Agreement does not authorize any of these tests.