Security testing without permission is illegal in most countries (for example the U.S. Computer Fraud and Abuse Act and the UK Computer Misuse Act). zAiBreach only lets an account test a site it can show it is entitled to test, and records every decision.
1. Test only what you are authorized to test
You may run active tests only against systems you own, or that you have written permission from the owner to test, within the scope and time window of that permission. Passive checks — the TLS certificate, the response headers of a page, the technology a page reveals and a domain's public mail records — observe what any visitor sees and are available to everyone.
2. How an account is authorized
Your organisation's domain. An account whose confirmed email address is at the site's domain (for example [email protected] for acme.com and its subdomains). Free email providers never count. Public-sector and military domains need a verified domain or our approval.
A verified domain. A DNS TXT record, a file on the site, or a code sent to the domain's administrative mailbox (admin@, administrator@, webmaster@, hostmaster@, postmaster@ or security@). Verifications are re-checked every 180 days.
Our approval. Ask from the app, tell us your relationship to the site and why you need to test it. We review the case and the domain's public records; approvals are for a limited time and can be revoked. If the public records name your own confirmed address, approval is immediate.
Testers and administrators. Vetted people who test under written engagements may test other sites. They remain bound by this policy and every test is recorded.
3. Never
Test a system without authorization, or beyond the scope or dates of your authorization.
Attempt denial of service, degrade a target's availability, or run tests at a rate the owner has not agreed to.
Access, change, copy or destroy data beyond what is needed to demonstrate a finding.
Use findings to attack, extort, or disclose a vulnerability to anyone but the owner.
Evade the authorization checks: other people's identities, disposable accounts, misleading requests, or addresses crafted to point the scanner somewhere else.
Share, resell or lend your account or API keys.
Test a domain whose owner asked us not to (the do-not-scan list).
4. What we record
Every authorization decision — allowed or refused — is recorded with the account, the source IP address, the target and the grounds. We keep these records to investigate abuse and to answer site owners who ask who tested them.
5. Enforcement
We may refuse a test, revoke an approval, suspend or close an account, and share records with the affected site owner or with law enforcement when required by law or to protect others. Abuse may lead to civil or criminal liability, which remains yours.
6. Site owners
Our scanners identify themselves in the User-Agent header (zAiBreach … (+https://pentestmyapps.com/security)). If you did not authorize a test, or want your domain excluded, see Security & abuse.