Penetration Testing Terms of Service

NightShift, operated by Skripted LLC

By checking the box and subscribing, you agree to these terms. Please read them before subscribing. If you do not agree, do not subscribe.

1. What we do

We perform automated penetration testing against the systems and assets you specify, and deliver written reports of our findings in your customer portal. Testing is black-box by default. If you optionally connect a source-code repository, we may use that source and associated security-analysis artifacts to discover test leads and explain root causes; suspected runtime vulnerabilities still go through our normal evidence and validation process. We identify vulnerabilities; we do not fix them. Implementing any remediation is your responsibility.

2. Rules of engagement

We test only the targets and methods you authorize. We do not perform denial-of-service testing unless you explicitly authorize it, and we do not extract data beyond what is needed to demonstrate a vulnerability. We do not perform social engineering, physical access, or insider-threat testing. We will halt testing immediately if you ask us to.

3. Authorization to test, and your ownership of the target

You must define the exact scope of the test (domains, IP addresses, and applications) before testing begins. By submitting that scope, you represent and warrant that you either own the target systems or have explicit written authorization from the owner to have them tested.

You authorize us to perform security testing against that defined scope for as long as your subscription is active (see Section 8), or, for a one-off purchase, during the time window we agree on. This authorization is limited to the scope you provide. You are solely responsible for any consequences of authorizing testing against systems you do not have the right to test, and you will indemnify us against any claim arising from such authorization.

If you connect a source-code repository, you also represent and warrant that you are authorized to grant us access to that repository and revision for this engagement. You must select only repositories that correspond to the application in scope. Repository authorization does not expand the network targets we are authorized to test.

4. Risks you accept

Penetration testing carries inherent risk. Although we take reasonable care to minimize impact, testing can in rare cases cause service disruption, performance degradation, or data issues. You are responsible for maintaining current backups before each test. We are not liable for downtime, data loss, or other consequences resulting from testing performed within the authorized scope.

5. Excluded systems

You will not include in scope, and we will not test, any system where the use or failure of that system could lead to death, personal injury, or environmental damage. This includes life-support systems, emergency services, nuclear facilities, autonomous vehicles, and air traffic control systems.

6. Your data and our reports

Findings, source code, and security-analysis artifacts may include sensitive information about your systems. We treat your data as confidential and use it only to deliver the service. Reports are for your use, including sharing them with your customers, auditors, and advisers.

Optional source access is read-only during a scan. We use short-lived repository credentials, copy the selected revision into transient scanner storage, and delete each scan's working tree and downloaded analysis artifacts after that scan. A source archive you upload may remain in private encrypted storage for authorized reruns until the expiry shown in your portal, never more than 24 hours; replacement, disconnection, or expiry makes it unavailable sooner. We may retain the repository name, exact commit identifier when available, archive digest, acquisition and authorization audit data, and the limited source citations needed to support your report; we do not retain the full repository as part of the report store.

You may disconnect a repository from an engagement in the customer portal. GitHub also notifies us when its App installation is deleted or suspended or when the selected repository is removed; we revoke matching future source access when we receive a valid signed notice. Every queued scan re-checks the current source authorization before launch. Disconnecting one engagement does not uninstall a GitHub App installation that you may use for another engagement.

Our service is not designed to store sensitive personal data (for example, health records, payment card data, or government identification numbers). You should not deliberately provide such data to us. We may retain anonymized, non-identifying technical data derived from the engagement to maintain and improve our service.

Our testing uses third-party AI services to analyze results. Target response data (such as URLs, headers, and response bodies) and limited source-code excerpts relevant to testing or root-cause analysis may be processed by these providers under their own terms. We do not intentionally send credentials or secrets discovered during testing to these providers. By subscribing or placing an order, and by optionally connecting source, you consent to this processing.

7. No guarantee of security

The service is provided on an "as is" and "as available" basis. We warrant only that the testing will be performed in a professional and workmanlike manner. We make no other warranties, express or implied, including any implied warranty of merchantability or fitness for a particular purpose. We do not warrant that the testing will identify every vulnerability, or that your systems are or will be secure. A clean or partial report reflects findings at a single point in time and is not a warranty of security.

8. Subscription, payment, and cancellation

Plan. The service is sold as a monthly subscription per application. The base subscription includes one application. You may add more applications from your customer portal at the additional-application price shown there. An application is one web app and the hosts it uses (for example app.example.com and api.example.com), verified through its domain; separate products and separate environments (such as staging and production) are separate applications. Fees are as listed at the time of purchase, plus applicable taxes, and are billed in advance each month until you cancel.

What each month includes. One full test of your application per billing month, and re-tests of previously reported findings on request, subject to fair use: up to three re-tests per day and thirty per billing month. An unused monthly full test does not carry over to the next month. We may queue requests so that only one test runs against your application at a time.

Adding or removing an application. When you add an application, Stripe prorates its additional monthly fee for the rest of the current billing month and charges it immediately. The application receives its current-month full test only after that payment succeeds. When you remove an application, testing access continues through the end of the current billing month and the lower quantity applies to the next invoice. We do not issue a credit or refund for the current month, except where required by law. You must keep at least one application on an active subscription.

Cancellation. You may cancel the whole subscription at any time from your customer portal. Cancellation takes effect at the end of the current billing month: testing continues until then, and no further charges are made. Fees already paid are non-refundable, except where required by law.

Failed payments. If a payment fails, testing is paused until payment succeeds. If the subscription ends for non-payment, the cancellation terms above apply.

Standing authorization. Your subscription authorizes recurring testing of the target you verified, for as long as the subscription is active. You must keep the domain-ownership proof (the DNS record or file we issued) in place; we re-check it before every test and do not test while it is missing. You may withdraw authorization at any time by removing the proof or cancelling.

Access to reports. Reports stay available in your customer portal while your subscription is active and for 30 days after it ends. Reports from a one-off purchase made before subscriptions were introduced remain available for 12 months from delivery.

Earlier one-off purchases. One-off purchases made before subscriptions were introduced remain governed by the terms that applied when they were bought.

Upgrading from a one-off. You may upgrade the target of a one-off purchase to the monthly subscription. The subscription terms apply to that target from the upgrade date. A one-off test still in progress is completed and delivered as purchased; monthly testing starts after it. Any introductory discount applies to the first billing month only and to your account's first subscription.

9. Limitation of liability

To the maximum extent permitted by law, our total aggregate liability arising out of or related to the service will not exceed the fees you paid us in the three months before the event giving rise to the claim or, for a one-off purchase, the amount you paid for that purchase. We will not be liable for any lost profits, loss of data, or any indirect, incidental, special, punitive, or consequential damages, regardless of whether we were advised of the possibility of such damages.

10. Acceptable use

You will not use our findings or reports for any unlawful purpose, or to test, access, or interfere with any system outside the authorized scope.

11. Changes to these terms

We may update these terms from time to time. We will email subscribers before a material change takes effect; it applies from your next billing month, and you may cancel before then. For a one-off purchase, the version in effect at the time of purchase applies.

12. Governing law and dispute resolution

These terms are governed by the laws of the State of New York, USA, without regard to its conflict-of-laws rules.

Any dispute arising out of or relating to these terms or the service will be resolved by binding arbitration seated in New York, New York, rather than in court. Judgment on the arbitration award may be entered in any court of competent jurisdiction.

To the extent permitted by law, disputes will be resolved only on an individual basis, and you waive any right to bring or participate in a class, collective, or representative action.