Terms of Service

1. Acceptance

These Terms govern your use of breach403 (the "Service"), operated by Bent Eisheuer. By starting a scan, creating an account, or purchasing credits, you accept these Terms. If you do not agree, do not use the Service. You must be at least 18 years old, or the age of legal majority in your jurisdiction if higher, and have the legal capacity to enter into this agreement, to use the Service.

Target market. The Service is commercially directed exclusively at customers in Germany. We do not actively market or offer paid services in other countries. Technical availability of the free website elsewhere does not expand that commercial target market. Mandatory law that nevertheless applies to a particular user remains unaffected.

2. What the Service does

breach403 runs an automated external security scan against a website and produces a plain-language report of what it found: exposed configuration files, missing security headers, outdated software, weak TLS or DNS/email settings, and similar misconfigurations. Every check is non-destructive: read-only or idempotent requests only (see §4). The currently available free tier produces a deterministic, non-AI report at no cost. AI-enhanced reports and credit purchases are presently unavailable. Existing credits remain preserved but cannot be spent while the feature is paused; §6 governs them if checkout is enabled in the future.

What the scan does today.The scan maps your site's reachable surface and inspects it through observation and safe, read-only requests: it retrieves pages and files, reads response headers and TLS certificates, and checks DNS and email-authentication records. It does not currently perform active injection testing (for example, sending crafted cross-site-scripting or SQL-injection probes to your parameters). That deeper, active testing is a capability that is presently disabled for all users. If it is ever enabled, it will run only against a domain whose ownership you have proven, and only after you give a separate, explicit authorization for active testing at that time. It is never switched on silently.

Current scope. Every scan today is passive and non-destructive — read-only or idempotent requests only (see §4) — and runs only against a domain whose ownership you have verified (§3). We do not currently perform active injection testing, and we never scan a domain you have not proven you control.

The Service is not a certification, a penetration-test sign-off, or a guarantee of security. It reports what our automated checks observed at the time of the scan. A clean report does not mean your site has no vulnerabilities. It only means our checks did not find one. You remain solely responsible for the security of your own systems.

3. You must own or be authorized to scan the target: this is the core rule

By submitting a domain and completing our ownership-verification process, you represent and warrant that you own that domain, or you are its authorized operator with the legal right to commission a security test of it. Ownership verification (a DNS TXT record, an HTML meta tag, or a file you place on the domain) is how you demonstrate this to us. It is not a substitute for actually having that authorization. Submitting a domain you do not own or control, or falsely claiming authorization on someone else's behalf, is a breach of these Terms and may itself be unlawful (e.g. under the German Criminal Code, §§ 202a to 202d StGB, or equivalent laws elsewhere).

We re-verify your proof of ownership immediately before every scan, not only when you first submit the domain, because verification can lapse (a DNS record can be removed, a domain can change hands). A scan will not run if re-verification fails.

Authorization you give. By completing ownership verification and starting a scan, you authorize breach403 to run its automated, non-destructive scan (as described in §2) against the verified domain and its subdomains. As stated in §2, the scan today performs only read-only or idempotent requests; the deeper, active injection testing described there is currently disabled, and if it is ever enabled it will require a separate, explicit authorization from you at that time. We never test any domain, subdomain, or system outside the ownership boundary you verified.

Third-party hosting & infrastructure. Owning or controlling a domain is not, by itself, authorization to security-test the infrastructure it runs on if that infrastructure belongs to someone else (e.g. a cloud host, CDN, or platform provider). You are responsible for ensuring your use of the Service also complies with any separate terms your hosting or infrastructure providers impose on security testing of systems they operate.

Indemnification. You agree to indemnify, defend, and hold Bent Eisheuer harmless from and against any claim, demand, loss, liability, damage, or cost (including reasonable legal fees) arising out of or related to your breach of this section — in particular any claim by the actual owner or operator of a domain that you caused it to be scanned without their authorization, and any claim by a hosting or infrastructure provider that your use of the Service violated terms you owed them independently of your relationship with us. This obligation survives the end of your use of the Service.

4. What the Service will never do

Every check the Service performs is designed to be non-destructive: read-only or idempotent requests only. The Service does not, and will not, attempt to: cause a denial of service or degrade the target's availability; modify, delete, or exfiltrate data on the target; attempt to actually exploit a detected vulnerability (as opposed to safely detecting it); or submit credentials to any login form it finds. Rate limits, timeouts, and a guard against scanning private/internal network addresses are enforced automatically. This floor is absolute. It is never relaxed to go "deeper," on any tier of the Service.

5. Accounts

You can use the free scan without creating an account (an anonymous session is created automatically). Creating a real account (email and password) preserves your scans in an account; it does not currently unlock a free AI report. You are responsible for keeping your account credentials confidential and for all activity under your account. Notify us promptly at legetdev@gmail.com if you suspect unauthorized access.

6. Payment & credits

Checkout is currently unavailable. If sales are enabled, AI-scan credits will be a pay-per-use purchase (not a subscription): a fixed pack of credits for a one-time price, each credit unlocking one AI-enhanced report. Credits do not expire unless stated otherwise at the time of purchase. Purchases are processed by Lemon Squeezy, acting as merchant of record. Lemon Squeezy is the seller for these transactions, handles payment and applicable VAT, and its own terms govern the payment itself. See Refund & Withdrawal for your cancellation rights on a purchase.

The currently offered deterministic scan does not require payment or a credit balance. Any future price or scope change will apply prospectively and be shown before use or purchase.

7. Acceptable use

You agree not to:

• Submit a domain you do not own or are not authorized to have tested (§3).
• Use the Service to scan, probe, or otherwise test any system other than the domain you verified.
• Attempt to circumvent rate limits, the ownership-verification gate, or any other technical control.
• Use the Service, or any output it produces, to facilitate an attack against any third party.
• Resell, sublicense, or provide the Service to third parties as if it were your own product, without our prior written consent.
• Attempt to reverse-engineer, extract, or replicate the Service's detection logic or templates for a competing product.
• Use the Service for any purpose that is illegal under applicable law.

We may suspend or terminate an account for a material breach of this section. We will give a warning and a reasonable opportunity to cure where the circumstances permit; immediate suspension remains possible where necessary to prevent abuse or protect a third party. Statutory refund rights and Lemon Squeezy's obligations as merchant of record remain unaffected.

8. Third-party services

The Service relies on third-party infrastructure and AI providers (see Privacy Policy for the full list). Their availability may affect the Service. Our liability for any resulting failure is governed by §10; mandatory statutory rights remain unaffected. Where possible, AI failure falls back to a deterministic report.

9. Intellectual property

The Service, its underlying software, and its content (excluding your own scan results and any third-party open-source components it uses) are our property or licensed to us. We grant you a limited, non-exclusive, non-transferable right to use the Service for its intended purpose. Your scan reports and findings are yours to use as you see fit.

10. Liability

We are liable without limitation for intent and gross negligence; injury to life, body, or health; liability under the Product Liability Act; an expressly assumed guarantee; and any other liability that German law does not permit us to limit.

For slight negligence, we are liable only for breach of an obligation whose performance is essential to the contract and on whose performance you may normally rely. In that case, liability is limited to the damage foreseeable and typical for this type of contract. The statutory rights for digital products under §§ 327 et seq. BGB and all mandatory consumer rights remain unaffected.

11. Term & termination

You may stop using the Service at any time; email legetdev@gmail.com to request deletion of your account and its data. We may suspend or terminate access for breach of these Terms (in particular §3 and §7), or discontinue the Service with reasonable advance notice where possible. If unused paid credits can no longer be used because we discontinue the Service, the seller will refund them unless a mandatory rule provides a more favorable remedy. Credits already consumed are refundable only as required by law or described in Refund & Withdrawal.

12. Changes to these Terms

We may update these Terms prospectively as the Service evolves. The version that applied when you authorized a scan or made a purchase remains recorded for that event. A material change affecting an existing contract takes effect only after we notify you in advance and obtain any agreement required by law; silence or continued use alone is not treated as consent where consent is required.

13. Governing law

These Terms are governed by the laws of Germany, excluding its conflict-of-law rules. As stated in §1, the Service is commercially directed exclusively at customers in Germany. Any mandatory law that nevertheless applies remains unaffected.

14. Severability

If any provision of these Terms is invalid or unenforceable, the remaining provisions stay in effect. The invalid provision is replaced only by the statutory rule that applies under § 306 BGB; no reduction or reinterpretation to preserve our preferred commercial result is agreed.

15. Contact

legetdev@gmail.com. See also the Imprint.