Terms of Service

Version [VERSION]. These Terms are read together with the Acceptable Use Policy and the Privacy Policy.

In short. Wsec is a tool for testing websites and code that you own or have permission to test. You are responsible for having that permission. The reports are information, not a guarantee, and the service is provided as it is. If your use of Wsec causes a claim against us, you cover it. This summary is for convenience and does not replace the terms below.
  1. Agreement to These Terms
  2. The Service
  3. Authorization and Ownership
  4. Acceptable Use
  5. How Scans Behave and Your Responsibility for Their Effects
  6. Reports and No Professional Advice
  7. No Warranty ("As Is")
  8. Limitation of Liability
  9. Indemnification
  10. Data, Source Code and Privacy
  11. Intellectual Property
  12. Suspension and Termination
  13. Changes to the Service and to These Terms
  14. Governing Law and Dispute Resolution
  15. General Provisions
  16. Contact

Agreement to These Terms

These Terms of Service (the "Terms") are an agreement between you and [OPERATOR NAME] (the "Operator", "we", "us" or "our"), which runs the Wsec web security checker at this website (the "Service"). By ticking the confirmation box before a scan, or by otherwise using the Service, you agree to these Terms, the Acceptable Use Policy and the Privacy Policy, which are part of this agreement. If you do not agree, do not use the Service.
You must be at least 18 years old, or the age of legal majority where you live, and able to enter a binding contract. If you use the Service for an organization, you confirm that you have authority to bind that organization to these Terms, and "you" includes the organization.
We record the version of the Terms you accepted together with each scan you start. You may be asked to accept again when the Terms change.
In these Terms: a "Target" is any website, host name, IP address, server, application or network that you ask Wsec to examine; "Source Code" is any files you upload to the Service for checking; a "Report" is any result, score, finding, explanation or configuration the Service produces; and the "Scanner Addresses" are the IP addresses published on the Whitelist page.

The Service

Wsec examines the externally visible security settings of a Target (such as TLS certificates, HTTP headers, cookies, DNS records and publicly reachable files) and analyses Source Code you upload for common security mistakes. It produces Reports with suggested fixes. Some checks, called "deep checks", request files that should not be public and run only after you prove control of the Target as described on the Verify page.
The Service does not require an account. We may add, change, limit or remove features, checks, rules, rate limits and file-size limits at any time. We do not promise that the Service will be available, uninterrupted, timely or free of errors.
The Service is provided free of charge unless we tell you otherwise in writing before you use a paid feature. If fees are introduced, they will be shown to you before you are charged.

Authorization and Ownership

You may ask Wsec to examine only Targets, and upload only Source Code, that you own or for which you have the express, current, written permission of the owner (and of any other person whose permission the law or a contract requires) to carry out the testing that Wsec performs. Examples of such persons include the owner of the website, the owner of the hosting account, and a hosting, cloud, content-delivery or security-service provider whose terms require advance approval for security testing.
Each time you start a scan or upload Source Code, you represent and warrant that:
Proving control of a Target through the Service (a file or a DNS record) is a technical safeguard. It is not legal authorization, it does not replace permission from others described above, and it does not make us responsible for deciding whether you are entitled to test the Target. We rely on your representations and are not required to verify them.
You are solely responsible for obtaining and keeping evidence of authorization, for telling your hosting provider, security team or other relevant parties about the testing where needed, and for complying with any testing policy that applies to the Target.
If you are the owner or operator of a Target and you do not want it examined by Wsec, you may ask us to block it by writing to [CONTACT EMAIL] as described in the Acceptable Use Policy. We may also decline or block any scan at our discretion.

Acceptable Use

You must follow the Acceptable Use Policy, which forbids, among other things, scanning without authorization, denial-of-service or excessive automated use, scraping or mass scanning, using the Service to prepare an attack, and trying to get around the Service's safeguards. A breach of the Acceptable Use Policy is a breach of these Terms.

How Scans Behave and Your Responsibility for Their Effects

Wsec sends a small number of read-only requests (mainly GET, HEAD and one OPTIONS request), opens a TLS connection and makes DNS queries. It does not submit forms, log in or try passwords. Requests identify themselves with a Wsec user agent and come from the Scanner Addresses.
Even light requests can be logged, can trigger alerts, can be blocked by firewalls or rate limiters, and in rare cases can affect fragile or misconfigured systems. You accept those risks. You are responsible for the effect of a scan on the Target and for any consequences of an alert or block, including costs, downtime and claims by others.
We design the Service to be gentle, but we do not guarantee that a scan will not disrupt a Target.

Reports and No Professional Advice

Reports are informational only. They are produced automatically from a limited set of checks at a single moment. They may contain false positives (reporting a problem that is not one) and false negatives (missing a real problem), and they may become wrong as soon as the Target or the Service changes.
A Report is not a security audit, a penetration test, a certification, an attestation of compliance with any law or standard (for example PCI DSS, SOC 2, ISO 27001, HIPAA or GDPR), or legal, security, engineering or other professional advice. A high score or a result with no findings does not mean that a Target or Source Code is secure, free of vulnerabilities, or safe from attack.
You are responsible for reviewing every finding, testing any fix or configuration before you use it (the suggested configuration is a starting point and may not suit your setup), and for your own decisions. Do not present a Report to others as proof of security or compliance.

No Warranty ("As Is")

THE SERVICE, THE REPORTS AND ALL CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, RELIABILITY, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.
WE DO NOT WARRANT THAT THE SERVICE WILL MEET YOUR REQUIREMENTS, THAT IT WILL BE UNINTERRUPTED OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, THAT THE REPORTS WILL BE ACCURATE OR COMPLETE, THAT ANY TARGET OR SOURCE CODE IS OR WILL BE SECURE OR "HACK-PROOF", OR THAT USE OF THE SERVICE WILL NOT DISRUPT ANY TARGET.
Some places do not allow certain warranties to be excluded. In those places, the exclusions above apply only as far as the law allows.

Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY LAW, THE OPERATOR AND ITS OWNERS, DIRECTORS, OFFICERS, EMPLOYEES, CONTRACTORS, AFFILIATES, LICENSORS AND HOSTING AND SERVICE PROVIDERS (TOGETHER, THE "WSEC PARTIES") WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, REPUTATION, DATA OR USE, COST OF SUBSTITUTE SERVICES, OR SECURITY INCIDENT OR BREACH, ARISING OUT OF OR RELATED TO THE SERVICE, THE REPORTS OR THESE TERMS, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, EVEN IF WE WERE TOLD THEY WERE POSSIBLE.
THIS INCLUDES ANY LOSS THAT RESULTS FROM YOUR RELIANCE ON A REPORT, FROM A VULNERABILITY OR ATTACK THE SERVICE DID NOT FIND OR DID NOT WARN YOU ABOUT, FROM A FALSE FINDING, FROM A CONFIGURATION YOU APPLIED BASED ON A REPORT, OR FROM THE EFFECT OF A SCAN ON ANY TARGET.
TO THE FULLEST EXTENT PERMITTED BY LAW, THE TOTAL LIABILITY OF THE WSEC PARTIES FOR ALL CLAIMS ARISING OUT OF OR RELATED TO THE SERVICE OR THESE TERMS WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID US FOR THE SERVICE IN THE TWELVE MONTHS BEFORE THE EVENT THAT GAVE RISE TO THE CLAIM AND (B) ONE HUNDRED US DOLLARS (USD 100).
These limits apply even if a remedy fails of its essential purpose, and they are a basic part of the bargain that allows us to offer the Service free of charge. Nothing in these Terms limits liability that cannot be limited by law, such as liability for fraud, for death or personal injury caused by negligence, or for anything else that the law of your place of residence does not allow to be limited. Any claim you have against us must be brought within one year after it arises, to the extent the law allows a shorter period than the usual one.

Indemnification

You will defend, indemnify and hold harmless the Wsec Parties from and against any claim, demand, suit, investigation or proceeding brought by a third party, and all resulting damages, losses, liabilities, fines, penalties, settlements, costs and expenses (including reasonable legal fees and costs of investigation), that arise out of or relate to:
We will tell you promptly about a claim, although a delay in telling you reduces your duty only to the extent you are harmed by it. You may control the defence with counsel reasonably acceptable to us, but you may not settle a claim in a way that admits fault by, or puts a duty on, any Wsec Party without our written consent. We may take part in the defence with our own counsel at our own cost. If you do not take over the defence promptly, we may defend the claim at your expense.
If you are a consumer in a place where this clause is not allowed, it applies only as far as the law permits.

Data, Source Code and Privacy

How we handle data is described in the Privacy Policy, which forms part of these Terms. In brief: scan results are kept for a limited period and then deleted; Source Code is analysed in memory and is not stored; visitor IP addresses are used for rate limiting and are not written to our database.
You grant us a limited, non-exclusive, worldwide licence to receive, copy, process and temporarily hold the Source Code and the Target information you give us, only to produce your Report, to operate and protect the Service, and to comply with law. We do not claim ownership of your Source Code or Target.
Do not upload personal data, live credentials, or confidential material that you are not allowed to share. If you do, you do so at your own risk and you are responsible for any consequences. A Report link can be opened by anyone who has it, so keep the link private.
We may disclose information if required by law, court order or a valid request from an authority, to protect the rights, safety or property of anyone, or to investigate and respond to abuse of the Service, including telling the owner of a Target or its hosting provider that scans were run against it.

Intellectual Property

The Service, including its software, rules, check descriptions, text, design and name, belongs to the Operator or its licensors and is protected by intellectual property laws. Subject to these Terms, we give you a limited, revocable, non-exclusive, non-transferable right to use the Service for your own lawful security testing. You may use your Reports for your own purposes, including sharing them with people who work on your Target.
You may not copy, resell, sublicense, offer the Service as your own, build a competing service from its output, scrape it, or reverse engineer it except as the law allows despite this restriction. If you send us feedback, you give us the right to use it without obligation to you.

Suspension and Termination

You may stop using the Service at any time. We may suspend or end your access, block an IP address or a Target, remove Reports, or refuse any scan at any time and for any reason, including a suspected breach of these Terms, a complaint from a Target's owner, a legal requirement, or a risk to the Service or to others, with or without notice. We are not liable for doing so.
Provisions that by their nature should continue after termination continue, including Authorization and Ownership, Reports and No Professional Advice, No Warranty, Limitation of Liability, Indemnification, Intellectual Property, Governing Law and Dispute Resolution, and General Provisions.

Changes to the Service and to These Terms

We may change these Terms. The version date at the top of this page shows the current version. When the change is material, we will ask you to accept the new version before your next scan. If you keep using the Service after a change takes effect, you accept the changed Terms. If you do not accept a change, stop using the Service.

Governing Law and Dispute Resolution

Governing law. These Terms and any dispute arising out of or related to them or the Service are governed by [GOVERNING LAW], without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
Informal resolution first. Before starting any formal proceeding, the party with the dispute must send the other a written notice that describes the dispute, the facts, and the outcome sought. For us, send it to [CONTACT EMAIL]. The parties will try in good faith to resolve it within thirty (30) days of the notice. Formal proceedings may not start until that period has ended, except to ask a court for urgent relief as described below.
Binding arbitration. If the dispute is not resolved within that time, it will be settled finally by binding arbitration under [ARBITRATION RULES AND SEAT], by one arbitrator, in English. The arbitrator's award is final and may be enforced in any court that has jurisdiction. The arbitration, and everything said or produced in it, will be kept confidential except as needed to enforce an award or as the law requires. Each party bears its own legal costs, and the arbitrator may not award punitive damages beyond what these Terms allow.
Individual claims only. To the fullest extent the law allows, disputes will be brought only in your or our individual capacity, and not as a plaintiff or class member in any class, collective, consolidated or representative action. Each party also waives any right to a jury trial where the law allows that waiver.
Exceptions. Either party may go to a court of competent jurisdiction (a) for temporary or permanent injunctive or other urgent relief to protect its intellectual property, confidential information or the security of its systems, (b) to enforce an arbitration award, or (c) to bring an individual claim in a small-claims court that has jurisdiction.
Mandatory consumer rights. If you are a consumer, nothing in this section takes away a right you have under the mandatory law of the place where you live, including any right to bring a claim in the courts of that place. If any part of this section is found unenforceable for you, the rest remains in force.

General Provisions

Entire agreement. These Terms, the Acceptable Use Policy and the Privacy Policy are the whole agreement between you and us about the Service and replace earlier understandings about it.
Severability and waiver. If a provision is found invalid or unenforceable, it will be limited or removed to the smallest extent needed and the rest will stay in force. A failure to enforce a provision is not a waiver of it.
Assignment. You may not assign or transfer your rights or duties under these Terms without our written consent. We may assign ours, including to a successor of the Service.
Events beyond our control. We are not liable for a delay or failure caused by events beyond our reasonable control, including outages of internet, hosting or power services, attacks on the Service, and acts of government.
Sanctions and export. You may not use the Service if you are barred from receiving it under applicable sanctions or export laws, and you will not use it in breach of those laws.
Relationship and third parties. You and we are independent parties. No agency, partnership or employment relationship is created. Except for the Wsec Parties, who may rely on these Terms, no one other than you and us has rights under them.
Notices. We may give you notice by posting it on the Service or, if you have given us an email address, by email. You may give us notice at the address in the Contact section.
Language and headings. These Terms are written in English, and that version controls. Headings are for convenience only.

Contact

[OPERATOR NAME]
[REGISTERED ADDRESS]
Email: [CONTACT EMAIL]

Acceptable Use Policy | Privacy Policy | About Wsec