Terms of Service

1. Service Description

unpwned (“we”, “us”, “our”) is an automated security scanning platform accessible at unpwned.io. The service scans domains and infrastructure using deterministic security checks and maintained analysis rules, and delivers plain-English vulnerability reports and recommended fixes to subscribers (“you”, “user”). An optional AI provider may draft only the report executive summary as described in Section 7a.

unpwned is a software-as-a-service tool. It is not a law firm, insurance product, managed security provider, incident response retainer, compliance auditor, or professional certification body. No report, score, badge, recommendation, email, or support response creates a professional advisory relationship, fiduciary duty, insurer relationship, or duty to protect your systems.

By creating an account or using any part of the platform, you agree to these Terms of Service in full. If you do not agree, you must not use the service.

1a. Public Lookup Service

unpwned provides a public domain security lookup feature accessible without account registration. This feature displays limited security information including severity counts and finding category titles derived from previously conducted scans. A currently owner-verified report may display an official score and letter grade when coverage requirements are met. A fresh bounded public check may display only an assessed score and never an official letter grade. If no recent scan exists, the feature may allow a visitor to start a fresh public scan without creating an account.

Public lookup results are provided for general informational purposes only and are subject to all disclaimers and limitations of liability described in these Terms. Public results do not include detailed vulnerability descriptions, remediation guidance, AI-ready Fix Prompts, or any information identifying the account that initiated the original scan.

Before starting a fresh public scan, you must confirm that you own the domain or have explicit written authorization from the domain owner. This confirmation is a legally binding representation and is logged as described in Section 3a. Anonymous or no-account use does not reduce your responsibility for unauthorized scanning.

By using the public lookup feature or starting a public scan, you agree to these Terms of Service, including Sections 3 (Authorized Scanning), 9 (Limitation of Liability), and 10 (Disclaimer of Warranties).

unpwned reserves the right to modify, limit, or discontinue the public lookup feature at any time without notice.

1b. Public Reports, Badges, and Third-Party Reliance

If you start a no-account public scan, choose to make a report public, share a report link, display an UNPWNED badge, or otherwise publish scan output, you are solely responsible for that publication and for confirming that you have the right to disclose the related security information. Public reports and badges are convenience features only.

A badge, grade, score, public report, or “verified” label is not a certification, warranty, audit opinion, attestation, seal of approval, or guarantee that a website is secure or compliant. Third parties must not rely on UNPWNED output as proof of security, compliance, insurance eligibility, procurement readiness, or legal due diligence.

unpwned may revoke, hide, expire, or recalculate public reports and badges at any time, including after methodology changes, newly discovered vulnerabilities, blocked scanner results, suspected misuse, account termination, or domain-owner opt-out.

1c. Programmatic Access, API Keys, and Connected AI Tools

unpwned may let you access the service programmatically using a personal API key, including by configuring a third-party AI assistant, coding agent, or developer tool (for example over the Model Context Protocol, MCP) with a key you generate. A tool you configure this way acts on your behalf and, subject to your plan, can start scans and read the scores, grades, findings, and remediation content of scans on your own account. Programmatic access is available only with a valid API key tied to your account, and each key is limited to one documented purpose, your own account, and your current plan. Before an MCP key is created, you must expressly authorize the delivery described below and accept these Terms and the Privacy Policy for your MCP use.

Your responsibility. You are responsible for the tools you choose to connect, for keeping API keys you provide to them secret, and for actions they take through your key. You may revoke an API key at any time from your account settings, and you must do so promptly if a key or a tool holding it is lost, compromised, or no longer trusted. Only connect tools you trust, and only scan a domain you own or are permitted to test under Section 3. This does not shift to you responsibility for a failure of unpwned’s own systems.

Data leaves unpwned. When you direct a connected tool to read your data, unpwned delivers that data to the tool or its provider at your request. Once received, its subsequent handling is governed by that tool’s or provider’s own terms and privacy policy. To the maximum extent permitted by law, unpwned is not responsible for that tool’s or provider’s later storage, transmission, or use of data you choose to send to it. unpwned’s own Privacy Policy continues to govern how unpwned delivers it.

Programmatic and connected-tool access is subject to the same authorization requirements (Section 3), Acceptable Use Policy (Section 5), and fair-use limits (Section 6) as any other use of the service. Official API and connected-tool access under this Section is permitted within documented limits; unlimited re-scans are not a license for bulk or abusive automation, or for programmatic scanning outside officially provided access. Automated access that is unauthorized, abusive, or materially exceeds ordinary individual use may be throttled, queued, or blocked, and connected-tool access does not grant any entitlement beyond your current plan.

2. Eligibility

You must be at least 18 years old and capable of forming a legally binding contract to use unpwned. By using the service you represent that all information you provide is accurate and that you have the authority to scan any domain you submit, either as its owner or with explicit written permission from the domain owner.

3. Authorized Scanning & User Indemnification

Every domain scan you initiate on unpwned constitutes a legally binding declaration that you are either (a) the registered owner of that domain, or (b) in possession of explicit written authorization from the domain owner to conduct security testing on their behalf. This is a contractual representation. It does not grant authority that you do not already possess or replace the verification controls described below.

Authorization declaration. Before each scan, including account-based scans and no-account public scans, you are required to check or otherwise submit a consent confirmation stating that you own or are authorized to scan the submitted domain. This confirmation records your representation and acceptance of these Terms, but it does not by itself prove that you control the domain or hold permission from its owner.

Standing authorization for vetted partners. Approved integration partners operating under a written partner agreement may rely on a standing, contract-based authorization for scans they submit through the Partner API, in place of a per-scan confirmation. Each such scan is still recorded with the partner's authorization basis and a corresponding audit record.

Recurring monitoring authorization. When you enable scheduled monitoring for a domain, your monitoring authorization applies to each recurring scan created under that monitoring configuration until you disable or delete the monitor. unpwned records the monitoring authorization timestamp, source, and hashed request metadata, and associates recurring monitoring scans with that authorization record.

Unauthorized scanning: consequences. If unpwned determines, in its sole discretion, that you have scanned a domain you do not own and for which you do not hold valid written authorization, your account will be immediately and permanently terminated without notice and without refund of any prepaid subscription fees. In addition, unpwned reserves the right to refer the matter, including the full consent audit log, to the relevant law-enforcement authorities and to the domain owner, and will cooperate fully with any resulting criminal or civil investigation.

Scanning a domain without ownership or written authorization may constitute a criminal offense under the Israeli Computers Law, 5755-1995 (Hok HaMahshevim), the U.S. Computer Fraud and Abuse Act (CFAA), applicable federal and state computer fraud statutes (including but not limited to California Penal Code Section 502, New York Penal Law Article 156), the UK Computer Misuse Act, and other applicable computer crime legislation. You acknowledge that you are solely responsible for ensuring your use of unpwned complies with all applicable laws before initiating any scan.

You agree to fully indemnify, defend, and hold harmless unpwned and its operators, directors, employees, and agents from and against any and all claims, damages, fines, penalties, legal fees, and liabilities of any kind arising out of or relating to: (i) your unauthorized scanning of any domain or system; (ii) your breach of any representation made in this section; (iii) any third-party claim that your use of the service violated their rights or applicable law; (iv) any unauthorized testing or activity conducted using the platform, including any claim by a third party alleging unauthorized access to or damage to their systems or data; or (v) any consequences arising from security alerts, log entries, or automated responses triggered on the target system as a result of a scan you initiated.

unpwned reserves the right to disclose your account information, scan history, consent audit logs, and any relevant data to law enforcement or affected third parties upon receipt of a valid legal request, and will cooperate fully with any investigation arising from unauthorized use of the platform.

4. Nature of Active Scanning

Where the applicable authorization and verification tier permits them, you acknowledge and consent to the following activities being performed against a domain you submit for scanning:

A no-account scan or an authorization declaration without current exact-host verification is restricted to bounded passive checks and does not receive an official security grade. Checks that request guessed paths, vary request origins or methods, test public data access, enumerate services, or otherwise probe beyond ordinary passive observation run only after current control of the exact target host has been verified. Deep Scan techniques also require the additional consents described below.

• Active HTTP and HTTPS requests to known sensitive paths, including but not limited to /.env, /.git/HEAD, /wp-config.php, and over 30 additional paths.
• Bounded HTTP and HTTPS HEAD reachability probes on a fixed set of common web-service ports. Standard and Deep Scans do not perform raw TCP or full-range port scanning.
• Unauthenticated requests to common API routes, including AI and LLM endpoints (e.g. /api/users, /api/admin, /api/chat, /api/ai) to test for improperly secured endpoints.
• GraphQL introspection queries to probe for exposed schemas at common paths (e.g. /graphql, /api/graphql).
• DNS record enumeration, including TXT, MX, SPF, DKIM, and DMARC lookups, as well as subdomain discovery via A/AAAA record resolution on common subdomain name patterns (e.g. api, admin, staging, dev) to map the attack surface of verified domains.
• JavaScript bundle analysis to scan for exposed API keys, secrets, and source map files.
• SSL/TLS handshake probing to assess certificate and cipher configuration.
• Supabase and Firebase public-client configuration analysis, using only embedded anon or browser API keys in their intended public role to test anonymous data access. Private, service-role, and user credentials are never used, and row or document contents are not retained in scan results.
• Rate limiting verification via bounded sequential requests within the published scanner rate limits.
• For a scan backed by current exact domain verification and a recorded authorization, retrieval and advisory evaluation of robots.txt crawler directives without allowing those directives to expand scope, permit authentication, or permit destructive activity. Public scans continue to enforce applicable crawler directives. HTTP rate-limit responses and Retry-After remain effective for every scan.
• Cloud storage bucket enumeration to test for publicly accessible S3-compatible storage.
• Non-destructive HTTP method capability checks using OPTIONS response headers and bounded TRACE echo probes. Standard and Deep Scans never send PUT, DELETE, or PATCH requests to the target.
• CORS policy testing by issuing requests with varying Origin headers to detect overly permissive cross-origin resource sharing configurations.
• Cloaking detection by issuing requests with different User-Agent strings (including search engine crawler identifiers such as Googlebot) to compare the content served to regular visitors versus search engine crawlers, in order to detect SEO spam injection, content cloaking, or indicators of site compromise. This includes fetching and analyzing sitemap.xml for suspicious sub-sitemap counts.
• On a manually initiated Deep Scan of a verified domain, limited SQL injection detection using rate-limited, read-only test values against discovered public HTTPS GET parameters. These probes do not submit forms, authenticate, extract database contents, or intentionally create, modify, or delete data.
• On the same limited Deep Scan path, reflected cross-site scripting detection using inert markers and non-executing test values against discovered public HTTPS GET parameters. These probes do not execute JavaScript in a browser, submit forms, bypass authentication, or intentionally create, modify, or delete data.
• On a Deep Scan of a domain whose ownership you have verified, and only where you have separately consented to intrusive probing, either per scan when you start it or by switching it on for that domain in your monitoring settings, bounded path traversal and local file inclusion probing. This sends no more than four requests whose paths use percent-encoded directory traversal to reach for a standard operating-system file, and records a finding only where the response actually returns that file's contents. These requests are read-only and never create, modify, or delete data. Your own server logs will record them as attack traffic. This probing is off by default, is never performed on standard scans, public checks, partner scans, or cached scans, and is not performed on scheduled monitoring unless you have switched it on for that domain.
• Known vulnerability (CVE) matching against detected technologies and their versions using data from the National Vulnerability Database (NVD), maintained by the National Institute of Standards and Technology (NIST). CVE data is synced periodically and matched locally; no scan data is sent to the NVD. This product uses the NVD API but is not endorsed or certified by the NVD.

Limited SQL injection and reflected cross-site scripting probes require all of the following: a manually initiated Deep Scan, current domain ownership verification, a dedicated per-scan consent, and an enabled server-side safety policy matching the policy version accepted by the user. They are not performed by standard scans, public checks, partner scans, cached scans, or scheduled monitoring.

All target HTTP requests originate from unpwned's infrastructure and include the User-Agent product token UNPWNED-Scanner/1.0. Browser-compatible and specialized test User-Agents retain this token. Eligible owner-verified target requests also carry the cryptographic Web Bot Auth identity described in the Scanning Policy. These requests will appear in the target server's access logs and may trigger security alerts, WAF rules, honeypot systems, intrusion detection systems, or automated blocking mechanisms on the target domain. Scans may also cause a temporary increase in log volume and a minor increase in network bandwidth usage on the target system. By submitting a domain for scanning, you explicitly consent to all of the above activities being performed on that domain and accept full responsibility for any consequences on the target system, including but not limited to automated security responses.

Proof of authorization. unpwned reserves the right to request, at any time, proof of authorization from the user who initiated a scan. If satisfactory proof is not provided within a reasonable timeframe, unpwned may suspend or permanently terminate the user's account and disclose relevant scan records to the affected domain owner or law enforcement.

For full details on our scanning methodology, User-Agent identification, and opt-out procedures for domain owners, see our Scanning Policy.

Subdomain scope. When you authorize a scan on a domain, it permits bounded DNS and certificate-transparency discovery of related hostnames, but it does not establish control of every discovered subdomain. Each hostname must have its own current exact-host control proof before UNPWNED sends owner-only, active, or intrusive probes to it. An apex-domain proof never authorizes active testing of a separate tenant, delegated hostname, shared-hosting customer, or third-party service. A discovered hostname without that proof remains limited to the bounded public visibility rules and cannot receive an official grade from a fresh public scan.

Third-party infrastructure disclaimer. Your authorization to scan a domain does not extend to third-party infrastructure providers (such as AWS, Cloudflare, Google Cloud, or shared hosting platforms). UNPWNED limits subdomain scanning on third-party infrastructure to non-destructive, publicly reachable requests that do not target or stress the provider's underlying shared infrastructure.

All scans are non-destructive. Standard scans send outside-in requests only to the public attack surface. Deep scans on verified domains may include the additional active testing techniques described above, but never write, modify, or delete data on your systems. UNPWNED does not weaponize a confirmed issue, persist access, use returned material as credentials, or continue beyond the bounded confirmation steps disclosed above. Findings are reported for remediation only.

Cached scan results. New public scan cache reuse is disabled as of August 15, 2026. Public Lookup may still display a clearly dated historical report that was already published, but requesting a new accepted public check does not clone another user's cached report. Historical cached reports remain marked as cached. Detailed remediation guidance, business impact analysis, technical detail, plain-English explanations, credentials, and external references are never transferred between users. UNPWNED will not re-enable cross-user cache reuse unless the clone preserves a bounded partial result, withholds an official grade, excludes sensitive details, and remains clearly disclosed.

5. Acceptable Use Policy

You agree not to use unpwned to:

• Scan domains, IPs, or infrastructure you do not own or lack explicit permission to test.
• Conduct or facilitate any form of attack, intrusion, or unauthorized access against any system.
• Reverse-engineer, scrape, or otherwise extract data from the platform beyond normal use.
• Resell, sublicense, or redistribute scan results or reports without prior written consent.
• Violate any applicable law or regulation, including computer fraud and abuse statutes.
• Upload or transmit malware, malicious code, or any content that could harm the platform or its users.
• Circumvent rate limits, quotas, or subscription restrictions through automated means.
• Use the public lookup feature to conduct competitive intelligence gathering at scale, automated bulk queries, or any form of systematic data extraction.

We reserve the right to suspend or permanently terminate accounts found in violation of this policy without notice and without refund.

Automated access and scraping. You may not use any automated tool, script, bot, crawler, or scraper to access, extract, or collect data from the unpwned platform, including but not limited to scan results, security scores, report content, API responses, or public lookup data, except through officially provided APIs within their documented rate limits or where expressly authorized in writing under our Vulnerability Disclosure Policy. Unauthorized automated access constitutes a violation of these Terms and may result in immediate IP blocking, account termination, and legal action under applicable computer fraud statutes.

6. Subscription Plans & Billing

unpwned offers the following subscription plans (all prices in USD):

• Free: $0/month, 2 scans per month. A bounded public check shows the severity breakdown, per-category assessed breakdown, and finding titles from completed checks. It may show an assessed score when evidence supports one, but it never publishes an official grade. Current ownership verification unlocks owner-authorized checks and official-grade eligibility; the active-testing tier requires separate explicit authorization. A category whose checks could not be completed is shown as not checked rather than as a passing score. Includes one (1) lifetime deep scan on a verified domain; additional deep scans require a paid plan. Includes the attack surface view for verified domains, showing the count of exposed assets in each layer. The Free plan does not include the itemized attack surface inventory or its scan-to-scan change summary, re-scanning a previously scanned domain to confirm a fix, the before/after fix-verification comparison, finding details, business impact explanations, technical remediation steps, AI fix prompts, PDF export, monitoring, GitHub integration, the score trend over time, or security badge. The Free plan does include access to your own past scans and reports, at the same level of detail they were shown when they ran.
• Solo: $9/month (or $90/year, equivalent to $7.50/month), 1 monitored domain, unlimited re-scans subject to fair use, fix verification with re-scan and before/after comparison, the full attack surface inventory with its scan-to-scan change summary and export, unlimited deep scans on verified domains, GitHub repository scanning for the repositories you connect, with weekly or monthly monitoring frequency.
• Studio: $29/month (or $290/year, equivalent to about $24.17/month), up to 5 monitored domains, unlimited re-scans subject to fair use, fix verification with re-scan and before/after comparison, the full attack surface inventory with its scan-to-scan change summary and export, unlimited deep scans on verified domains, GitHub repository scanning for the repositories you connect, with every-3-days, weekly, or monthly monitoring frequency, and priority support.
• Scale: $49/month (or $490/year, equivalent to about $40.83/month), up to 15 monitored domains, unlimited re-scans subject to fair use, fix verification with re-scan and before/after comparison, the full attack surface inventory with its scan-to-scan change summary and export, unlimited deep scans on verified domains, GitHub repository scanning for the repositories you connect, with daily, every-3-days, weekly, or monthly monitoring frequency, and priority support.

Customers who subscribed before the July 2026 plan update remain on their original plan at their original price and terms for as long as their subscription stays active and unchanged.

Fair use of unlimited re-scans. “Unlimited re-scans” means you may re-scan the domains monitored under your plan as often as you reasonably need to check and verify their security posture through normal, interactive use of the platform, including through official API and connected-tool access under Section 1c within its documented limits. It is not a license for scripted, bulk, or abusive automation, for programmatic scanning outside officially provided access, for scanning domains beyond the monitored-domain count of your plan, or for any use prohibited by Section 5 (Acceptable Use). To keep the service reliable and to protect our infrastructure and the infrastructure of the domains being scanned, we reserve the right to apply reasonable technical limits and to throttle, queue, or temporarily restrict re-scans that materially exceed ordinary individual use or that indicate abuse. Where your use is in good faith, we will contact you and, where practical, give you an opportunity to adjust before applying any restriction, except where immediate action is needed to protect the platform, other users, or target systems.

Monthly plans are billed in advance on the same date each month and renew automatically unless cancelled before the renewal date. Annual plans are billed as a single upfront payment covering 12 months and renew annually unless cancelled before the renewal date. Scan quotas reset at the start of each billing cycle.

All payments are processed by Freemius, which acts as merchant of record for paid UNPWNED subscriptions. By subscribing to a paid plan you agree to Freemius's applicable checkout, payment, tax, subscription, and refund terms in addition to these Terms. unpwned does not store your payment credentials.

You can review the Freemius Terms of Sale, Subscription Policy, and Refund Policy. Paid customers can manage invoices, payment methods, and subscriptions in the UNPWNED Customer Portal.

We reserve the right to change pricing with 30 days’ advance notice delivered by email or in-app notification. Continued use of a paid plan after a price change takes effect constitutes acceptance of the new pricing.

Paid fix verification entitlement. Paid plans include fix verification: the ability to re-scan a previously scanned domain to confirm that a remediation worked, together with a before/after comparison of the security score, grade, and findings between the earlier scan and the re-scan. Fix verification, the before/after comparison, and re-scanning a domain that has already been scanned are paid features and are not available on the Free plan.

Free plan changes. The Free plan is provided without consideration. UNPWNED reserves the right to modify, limit, suspend, or discontinue the Free plan at any time and for any reason, including changes to monthly scan quotas and feature availability, and reserves the right to meter, throttle, or limit free scans, including limiting Free users to the first scan of a domain and reserving re-scans and fix verification for paid plans, without advance notice. These changes do not apply to active paid subscriptions, which remain subject to the 30-day advance notice described above.

6a. Refund and Cancellation Policy

You may cancel your subscription at any time from the account billing dashboard. Cancellation takes effect at the end of the current paid period; you will retain full access to your plan features until that date.

30-day refund guarantee. If you are not satisfied with your purchase for any reason, you may request a full refund within 30 days of the original purchase date, no questions asked. This applies to the first purchase of a monthly or an annual plan.

What the guarantee does not cover. The refund policy published for this product through Freemius, the merchant of record, excludes the payments listed below, so the 30-day guarantee does not extend to them:

• renewal payments, including the automatic renewal of a monthly or annual subscription
• upgrades within the same plan, such as adding license activations
• upgrades from one plan to another
• a change to a different billing cycle, such as moving from monthly to annual
• purchasing an additional license under a plan

We decide, Freemius pays out. To request a refund, email support@unpwned.io with your account email and order details. We aim to answer within 3 business days. The decision on your request is ours. Freemius, as merchant of record, then issues the refund to your payment method, and how long it takes to appear there depends on your bank and card scheme rather than on us.

Chargebacks, payment disputes, suspected fraud, or abusive refund activity may result in account suspension, loss of access to paid features, or termination where permitted by law.

Statutory rights come first. The exclusions above are limits on our voluntary 30-day guarantee only. They do not limit, and must not be read as waiving, any cancellation, withdrawal, or refund right you have under the consumer law of your country that cannot be waived by agreement. Where such a right applies, it applies regardless of the list above, including to a renewal or an upgrade. If you believe you have such a right and a refund was refused, email support@unpwned.io and we will take it up with Freemius on your behalf.

Promotional trial periods. Certain promotional codes grant a free trial period before the first billing cycle begins. No charge is applied during the trial. If you cancel before the trial period expires, you will not be billed. If you do not cancel before the trial ends, your selected plan will activate and the first payment will be processed automatically. The 30-day refund guarantee applies from the date the first paid charge is made.

Complimentary access trials. Separately from promotional codes, we may grant new users a complimentary, time-limited trial of paid features without requiring payment or payment details. No charge is applied during or after such a trial, and no payment method is collected. When the trial period ends, your account automatically reverts to the Free plan unless you choose to subscribe to a paid plan. These complimentary trials may be offered to a subset of new users at our discretion, and we may change or discontinue them at any time.

Israeli consumer rights. For users in Israel: Your statutory cancellation rights under the Consumer Protection Law, 5741-1981 (Hok Haganat HaTzarchan) and the Transaction Cancellation regulations for distance transactions (14-day cooling-off period) are preserved and cannot be waived by these Terms. On a first purchase the 30-day money-back guarantee runs longer than the statutory cooling-off period. On a renewal or an upgrade, where that guarantee does not apply, your statutory rights are what govern, and they are unaffected by the exclusions above.

7. Free Plan Limitations

The Free plan is provided as-is for evaluation purposes and is subject to daily and monthly scan quotas as described on the pricing page. We may modify or discontinue the Free plan at any time without liability.

7a. Automated Fix Guidance and Optional AI Summaries

Vulnerability findings, severity ratings, scores, and remediation guidance produced by unpwned are generated from deterministic scanner evidence and maintained remediation rules. Paid reports may also include prompts designed to be pasted into an AI coding tool. These report materials are provided for informational purposes only. They do not constitute professional security advice, penetration-testing findings, legal security certification, or any form of guarantee regarding the security posture of your systems.

Professional review required before production use. You must not implement report guidance or output returned by an external AI tool directly into a production environment without first having it reviewed and validated by a qualified, independent cybersecurity professional. unpwned guidance and Fix It Prompts are a starting point for remediation, not a finished remediation plan. Complexity, system-specific configuration, and interdependencies between software components mean that implementing guidance without expert review may introduce new vulnerabilities, cause system instability, or fail to fully remediate the identified issue.

No liability for remediation implementation. To the maximum extent permitted by applicable law, unpwned expressly disclaims all liability for any damages, losses, security breaches, data loss, system outages, regulatory penalties, or other harm arising directly or indirectly from your implementation of report guidance, Fix It Prompts, or output from an external AI tool, whether or not it was reviewed by a security professional. This exclusion applies regardless of the legal theory asserted (contract, tort, negligence, strict liability, or otherwise) and even if unpwned was advised of the possibility of such damages.

Optional AI executive summary. A third-party AI model may draft the short executive summary of a report. It cannot create or alter findings, evidence, severity ratings, scores, or remediation instructions, and it is not allowed to make target requests. For that optional summary, unpwned transmits only the canonical domain name, normalized finding kind, category, severity and count, and valid CVE or GHSA identifiers where applicable. We do not send response bodies, affected paths, source or file contents, credential previews, your name, the email address on your account, your account ID, or your billing information, and nothing in the transmission links the scan to you as an account holder. We do not, however, claim that these transmissions contain no personal data at all: a domain name can itself be personal data where it relates to an identifiable individual, such as a personal site or a site whose registrant is a sole trader, and where that is the case the domain name is transmitted. Section 4A of our Privacy Policy sets out the basis and the safeguards for that transfer, and how to prevent it by turning off the AI report summary. Your scan data processed by third-party AI providers is subject to those providers' own terms of service, privacy policies, and data-handling practices. By using the AI report summary feature, you acknowledge and accept this third-party processing. We encourage you to review the terms of any AI provider whose services form part of your security workflow.

7b. User-Initiated Remediation, Coding Agents & “Fix It” Prompts

unpwned provides a “Copy Prompt” feature that generates pre-formatted instructions (“Fix It Prompts”) designed to be pasted into external AI-assisted coding tools, language-model interfaces, or any other software environment. These prompts are derived from vulnerability scan results and are intended solely as a convenience starting point for remediation.

Sole user responsibility. Any modification, configuration change, code edit, deployment action, or system alteration that you perform, whether by executing a Fix It Prompt in an external tool, manually implementing an output from an external AI tool, or taking any other remediation action informed by unpwned reports, is undertaken entirely at your own risk and sole responsibility. unpwned does not control, review, validate, or endorse the output produced by any external tool to which you supply a Fix It Prompt.

Assumption of risk. You expressly acknowledge and accept that implementing code changes, server configurations, DNS modifications, or any other technical alterations based on unpwned prompts or reports may result in, without limitation, application downtime, data loss, introduction of new security vulnerabilities, service degradation, regulatory non-compliance, or other adverse effects on your systems, products, or business operations. You assume full and exclusive responsibility for all consequences arising from such actions.

Complete disclaimer. To the maximum extent permitted by applicable law, unpwned, its operators, affiliates, directors, employees, and agents are not liable for any direct, indirect, incidental, special, consequential, or punitive damages, including but not limited to lost revenue, lost data, business interruption, reputational harm, or third-party claims, arising from or related to any action you take based on Fix It Prompts, output from external AI tools, scan reports, or any other information provided through the platform, regardless of the legal theory asserted and regardless of whether unpwned was advised of the possibility of such damages.

Mandatory professional review. Before implementing any change to a production system based on unpwned output, you must have the proposed change reviewed by a qualified professional with appropriate expertise in the relevant technical domain. Failure to obtain such review does not limit your responsibility under these Terms but may increase your exposure to adverse outcomes.

Repository prompts, autonomous coding agents, and credential rotation. The paragraphs above apply in full to Fix It Prompts generated from a repository scan, which cover an entire scan in a single prompt and are intended to be given to an AI-assisted coding tool that edits your source files. Where you supply such a prompt to a tool that applies changes without your review of each individual change, every change it makes is a change you have performed for the purposes of these Terms, and your responsibility for it is the same as if you had written it yourself. unpwned has no visibility into which changes such a tool makes, no ability to review or reverse them, and no control over the tool.

A repository Fix It Prompt may instruct that a credential found in your source code be rotated or revoked before any code is edited, because deleting a committed credential does not revoke it. You acknowledge that rotating or revoking a live credential can interrupt or disable your production systems and any service that depends on that credential, that identifying which credentials are live and sequencing their replacement safely is solely your responsibility, and that unpwned does not confirm with the issuer or provider whether any credential it reports is live, in use, or already revoked. Where a finding describes a credential as expired, that is read from a claim inside the credential itself and is not confirmation from anybody that it has been revoked. Nothing in a Fix It Prompt is an instruction you are obliged to follow, and the decision to act on any part of one, in what order, and with what safeguards, is yours alone. The disclaimer of liability above applies to every consequence of that decision.

7c. No Insurance, Legal Advice, or Incident Response

UNPWNED does not provide cyber insurance, legal advice, regulatory advice, compliance certification, breach counsel, incident response services, managed detection and response, or any financial guarantee against security incidents. You remain solely responsible for deciding whether to obtain legal counsel, insurance, professional security services, backups, monitoring, incident response coverage, and other risk-management measures.

Any business, legal, compliance, or operational impact language shown in reports is general educational information only. It must not be treated as legal advice, insurance advice, audit evidence, or a substitute for advice from qualified professionals familiar with your specific systems and jurisdiction.

8. Intellectual Property

All platform software, design, trademarks, and AI-generated report templates are the exclusive property of unpwned. You are granted a limited, non-exclusive, non-transferable license to use the platform solely for your own security monitoring purposes during an active subscription.

You retain ownership of your domain names and the raw scan data associated with your account. You grant unpwned a limited license to process and analyze that data solely to provide the service.

Feedback and suggestions. Any feedback, ideas, suggestions, feature requests, or other communications you voluntarily submit to unpwned regarding the platform or its services become the exclusive property of unpwned. You hereby irrevocably assign to unpwned all right, title, and interest in such feedback, including all intellectual property rights, without any obligation of compensation, attribution, or confidentiality. unpwned may use, reproduce, modify, distribute, and commercialize such feedback for any purpose without restriction.

8a. Security Telemetry and Aggregated Intelligence

By using the unpwned platform, including initiating any scan, you agree that unpwned may collect, store, and analyze technical security telemetry derived from scan activity for the purpose of building aggregated security intelligence, improving scanner accuracy, measuring scanner reliability, preventing abuse, and publishing market-level security trends.

What we collect. Telemetry is strictly limited to statistical and technical patterns derived from scan results. This includes, but is not limited to: security posture metrics and scores, vulnerability categories and severity levels, technology and infrastructure characteristics, protocol and configuration attributes, and industry-level classifications. All telemetry is collected at the pattern level only and may be expanded over time as the platform evolves.

Internal linkage. Internal telemetry records may be linked to the underlying scan ID so we can de-duplicate records, debug scanner behavior, suppress test scans, investigate abuse, and honor opt-out or deletion requests where applicable. This internal linkage is not included in public statistics, public research, or external datasets.

What we do not publish. Public telemetry, research, benchmarks, and threat statistics do not include your account identifier, billing data, email address, raw scan output, source-code file contents, API keys, secrets, credentials, or information that is intended to identify the original scanning user. Domain-level scores may still be shown through the public lookup feature as described in Section 1a.

Purpose and use. Aggregated telemetry may be used to publish anonymized industry research, security trend reports, and benchmark indices (such as framework security risk analyses). We design published telemetry so that no individual account or scan requester is identified.

You may opt out of telemetry collection at any time by emailing privacy@unpwned.io. Opting out does not affect your access to any platform features.

Aggregated security scores and finding category titles may also be displayed through unpwned's public domain lookup feature, which shows limited results without identifying the original scanning user or account.

9. Limitation of Liability

unpwned is a security monitoring and advisory tool. It does not guarantee the detection of all vulnerabilities, nor does it provide penetration testing or legal security certification. Scan results are informational only.

To the maximum extent permitted by applicable law, unpwned, Raz Azulay as sole proprietor, and any operators, contractors, service providers, affiliates, or agents shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages arising from your use of or inability to use the service, including but not limited to loss of data, security breaches, lost profits, business interruption, reputational harm, loss of goodwill, third-party claims, regulatory investigations, or remediation costs, even if advised of the possibility of such damages.

Our total aggregate liability for any claim arising out of these Terms shall not exceed the amount you paid us in the 12 months preceding the claim, or $100, whichever is greater.

No remediation obligation. unpwned is not obligated to monitor, follow up on, or verify whether vulnerabilities identified in scan reports have been remediated by the domain owner. The responsibility for evaluating, prioritizing, and remediating any identified security issues lies solely with you. unpwned shall not be held liable for any damages, breaches, or losses resulting from your decision not to remediate, or your delay in remediating, any vulnerability reported by the platform. Delivery of a scan report does not create a duty of care, an ongoing advisory relationship, or any obligation on the part of unpwned to ensure that reported vulnerabilities are addressed.

Nothing in these Terms excludes or limits our liability for: (a) death or personal injury caused by our negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot be excluded or limited by applicable law, including under Israeli, EU, or US consumer protection laws.

10. Disclaimer of Warranties

The service is provided “as is” and “as available” without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that the service will be uninterrupted, error-free, or completely secure.

No warranty of complete vulnerability coverage. We expressly do not warrant that any scan will detect all vulnerabilities present in a target domain, system, or associated infrastructure. unpwned's scan checks cover a defined set of security categories and are not a complete or exhaustive source of all known, unknown, or emerging vulnerabilities. Vulnerabilities may exist in your systems that fall outside the scope of unpwned's checks, that require authenticated access to detect, or that are not yet publicly disclosed at the time of scanning. The absence of findings, a clean scan result, or a high security score does not mean your systems are free of vulnerabilities.

Scan results are point-in-time only. New vulnerabilities are discovered and publicly disclosed on a daily basis. A scan result reflects the security posture of the target domain only at the specific date and time the scan was performed and may become outdated immediately thereafter. unpwned makes no warranty that a previously clean result remains accurate after the time of scanning. Furthermore, a passing scan or high security score does not constitute a security certification, compliance attestation, or guarantee of any kind with respect to any regulatory framework, industry standard, or contractual security obligation. You remain solely responsible for maintaining an ongoing security program and for engaging qualified professionals to assess your security posture.

11. DMCA & Copyright

If you believe any content on unpwned infringes your copyright, please send a notice tosupport@unpwned.io with:

• Identification of the copyrighted work claimed to be infringed.
• Identification of the infringing material and its location on the platform.
• Your contact information.
• A statement of good faith belief that the use is not authorized.
• A statement, under penalty of perjury, that the information in your notice is accurate.

We will investigate and respond to valid DMCA notices in accordance with applicable law.

Counter-notification. If you believe material was removed in error, you may submit a counter-notification to support@unpwned.io containing: (1) identification of the material removed; (2) a statement under penalty of perjury that removal was a mistake; (3) your name, address, and consent to Tel Aviv court jurisdiction; (4) your signature.

Repeat infringer policy. UNPWNED maintains a policy to terminate accounts of users who are repeat copyright infringers.

UNPWNED's scanning activities are limited to publicly accessible content and do not circumvent any technological protection measures within the meaning of DMCA Section 1201.

11b. Platform Security Research and Abuse

Except for good-faith security research conducted strictly in accordance with our published Vulnerability Disclosure Policy, you may not probe, test, attack, or exploit the security of the unpwned platform. Prohibited conduct includes attempting to escalate privileges; accessing another person's account, report, data, or credentials; manipulating subscription or billing records; bypassing authentication, authorization, rate limits, or security controls; creating accounts in bulk; or interfering with platform infrastructure.

Research that satisfies every condition of the Vulnerability Disclosure Policy is authorized by UNPWNED solely for the assets expressly listed in that policy. To the limited extent a restriction in these Terms would otherwise prohibit that compliant research, UNPWNED waives that restriction for that purpose only. This authorization does not extend to customer domains, scan targets, third-party services, or any system UNPWNED does not own and control, and it does not override applicable law.

Activity outside that limited authorization is a material breach of these Terms. UNPWNED may, without prior notice and where permitted by law, throttle or block access, revoke sessions or API credentials, suspend or terminate accounts without refund, retain relevant evidence in accordance with the Privacy Policy, notify infrastructure or service providers, seek civil relief, or refer suspected criminal conduct to the appropriate authorities. Enforcement decisions may consider intent, impact, repetition, and evasion of a prior warning, suspension, account restriction, IP block, or other security control.

Reports must be sent privately to security@unpwned.io. UNPWNED will not initiate civil action or request a law-enforcement investigation for accidental, good-faith conduct that complies with the Vulnerability Disclosure Policy. That safe harbor does not cover extortion, deliberate harm, privacy violations, data exfiltration, persistence, service disruption, unauthorized third-party testing, or attempts to evade enforcement. Human review of an automated block may be requested at support@unpwned.io.

11c. Security Incident Notification

In the event of a confirmed security incident that results in unauthorized access to user personal data or account credentials, unpwned will notify affected users and/or regulators where required by applicable data protection law, including the EU General Data Protection Regulation (GDPR) where applicable.

Notification will include: a description of the nature of the incident, the categories of data affected, the measures taken to address the breach, and recommended steps users should take to protect themselves. unpwned will also notify the relevant supervisory authority where required by law.

Password security. User passwords are stored exclusively as one-way cryptographic hashes (bcrypt) and cannot be recovered or read in plaintext, even in the event of unauthorized database access. unpwned never stores, logs, or transmits passwords in cleartext.

12. Termination

You may cancel your account at any time from the account settings page. We reserve the right to suspend or terminate your account immediately for violations of these Terms, non-payment, or any activity we determine to be harmful to the platform or other users.

Upon termination, your right to access the service ceases immediately. We may delete your data in accordance with our Privacy Policy.

13. Governing Law

These Terms are governed by and construed in accordance with the laws of the State of Israel, without regard to conflict of law principles. Any dispute arising from or relating to these Terms or your use of the Service shall be subject to the exclusive jurisdiction of the competent courts in Tel Aviv-Jaffa, Israel. Notwithstanding the foregoing, we reserve the right to seek injunctive relief in any court of competent jurisdiction to protect our intellectual property rights.

Notwithstanding the foregoing, nothing in these Terms prevents either party from seeking injunctive or other equitable relief in any court of competent jurisdiction. Users in the United States may bring individual claims in their local small claims court, provided the claim falls within the court's jurisdictional limits.

Class action waiver. To the maximum extent permitted by applicable law, you agree that any dispute arising out of or relating to these Terms or your use of the service shall be resolved on an individual basis only. You waive any right to participate in any class action, class arbitration, consolidated action, or representative proceeding against unpwned. If this waiver is found to be unenforceable in your jurisdiction, the remainder of this dispute resolution section shall continue to apply in full.

13a. California Privacy Rights (CCPA/CPRA)

For users in California: Additional privacy rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) are described in our Privacy Policy. You may exercise your right to opt out of the sale or sharing of personal information via the “Do Not Sell or Share” link in our website footer.

14. Changes to These Terms

We may update these Terms from time to time. Changes take effect when posted unless we state a later effective date or applicable law requires advance notice or consent. We may also notify you of material changes by email or via an in-app notice. Continued use of the service after the effective date constitutes acceptance.

15. Email Communications

Transactional emails. Emails related to scan results, security alerts, account notifications, billing confirmations, and service operation are sent as necessary for the provision of the service and do not require separate opt-in consent.

Marketing emails. Promotional and marketing emails, including product announcements, feature updates, and special offers, are sent on the basis of our legitimate interest in keeping account holders informed about the service. We do not require prior opt-in consent for these messages, except where applicable law requires it. Every such email includes a one-click unsubscribe link, and you may opt out at any time.

Unsubscribe requests are honored promptly. In accordance with the CAN-SPAM Act (15 U.S.C. 7701 et seq.), all commercial emails include a clear unsubscribe mechanism and our business contact details.

16. Force Majeure

Neither party shall be liable for any failure or delay in performing its obligations under these Terms to the extent that such failure or delay results from circumstances beyond the party's reasonable control, including but not limited to: acts of God, natural disasters, epidemics or pandemics, war, terrorism, riots, civil unrest, government actions or sanctions, embargoes, fire, flood, earthquake, power outages, internet or telecommunications failures, cyberattacks on third-party infrastructure (including hosting providers such as Vercel, Supabase, or Cloudflare), strikes or labor disputes, or any other event that could not have been reasonably foreseen or prevented.

The affected party shall promptly notify the other party of the force majeure event and use commercially reasonable efforts to mitigate its effects. If a force majeure event continues for more than 30 consecutive days, either party may terminate the affected services without liability, and unpwned shall issue a pro rata refund for any prepaid fees covering the period of unavailability.

17. Assignment

You may not assign, transfer, delegate, or sublicense any of your rights or obligations under these Terms without the prior written consent of unpwned. Any attempted assignment without consent shall be void and of no effect.

unpwned may assign these Terms, in whole or in part, to any affiliate or successor entity in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets, provided that the assignee agrees to be bound by these Terms.

18. Export Control and Sanctions Compliance

You represent and warrant that you are not located in, under the control of, or a national or resident of any country subject to comprehensive trade sanctions, including but not limited to those imposed by the United States (OFAC), the European Union, the United Nations, or the State of Israel.

You may not use unpwned if you are listed on any sanctions or restricted party list, including the U.S. Specially Designated Nationals (SDN) list, the EU Consolidated Sanctions list, or any equivalent list maintained by applicable governmental authorities. You agree not to use the service for any purpose prohibited by applicable export control laws.

unpwned reserves the right to suspend or terminate accounts and block access from jurisdictions subject to sanctions at any time without notice.

19. Publicity

By subscribing to a paid plan, you grant unpwned the right to identify you as a customer and to use your company name, trademark, and logo in marketing materials, customer lists, case studies, and on the unpwned website, unless you notify us in writing at support@unpwned.io that you wish to opt out. We will remove your information within 10 business days of receiving such request.

20. Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if modification is not possible, shall be severed from these Terms. The invalidity or unenforceability of any provision shall not affect the validity or enforceability of the remaining provisions, which shall continue in full force and effect.

21. Entire Agreement

These Terms, together with the Privacy Policy, Scanning Policy, and any applicable Data Processing Agreements, constitute the entire agreement between you and unpwned with respect to the use of the service. These Terms supersede all prior or contemporaneous communications, proposals, and agreements, whether oral or written, between you and unpwned regarding the subject matter hereof.

No waiver of any provision of these Terms shall be deemed a further or continuing waiver of such provision or any other provision. unpwned's failure to enforce any right or provision of these Terms shall not constitute a waiver of such right or provision.

22. Contact

Questions about these Terms? Email us at support@unpwned.io.