The rules,
in plain words.

01 The website

You may read, link to and share this website. The text, design and logo belong to SegfaultSec. Do not copy them to present as your own.

02 The free audit

The free audit is a look at the public side of a website you own or are allowed to have tested. Only send us a site you have that right for. We look from the outside, the way a visitor would; we do not attack, overload or log into anything without written permission.

The audit is advice, given in good faith. It is not a guarantee that a system is fast or secure.

03 Paid work

Every project, subscription and audit we are paid for has its own written agreement or order with the scope, the price, the dates and who owns what. Where that agreement and this page differ, the agreement wins.

Unless an agreement says otherwise: you own the code we write for you once it is paid, you can take it elsewhere, and there is no exit fee.

04 Payments

Invoices show the price, currency and due date. You can pay by card through Stripe or Paddle, or by bank transfer. A late invoice can pause work until it is paid; we tell you before we do.

05 Our responsibility

We do the work with care and skill. We are not responsible for losses caused by things outside our control, by changes made by others, or by the use of advice from the free audit. Nothing here limits responsibility that the law does not allow us to limit.

06 Security research

Testing our own systems is welcome under the rules of our vulnerability disclosure policy. Outside those rules, do not test our systems or our clients'.

07 Contact

Questions about these terms: hello@segfaultsec.org.