Our scanners identify themselves in the User-Agent header: zAiBreach <module>/1.0 (+https://pentestmyapps.com/security). Accounts may only test sites they have shown they are entitled to test (see the Acceptable Use Policy), and we record who tested what, from where, and on what grounds.
If you did not authorize a test, email [email protected] with the time, your domain and the source IP addresses you saw. We will investigate, stop the activity and tell you what we can.
Site owners can ask us never to test their domain from this service. Email us from an address at the domain (or with proof of control) and we add it to our do-not-scan list; tests of it are then refused to everyone.
We welcome reports. Email [email protected] with the steps to reproduce. Please test only against your own account, do not access other people's data, avoid degrading the service, and give us reasonable time to fix the issue before disclosure. We will not pursue good-faith research that follows these rules.
Machine-readable contact: /.well-known/security.txt (RFC 9116).