Acceptable Use and Testing Authorization

Only test what you are authorized to test. HyperSec runs real attacks. Pointing it at a system without permission can be illegal, and we will suspend accounts that do it. If you are not sure you are authorized, you are not.

• Systems that you or your organization own and operate.
• Systems owned by someone else who has given you explicit, current, written permission covering the targets, the kinds of tests and the dates.
• For applications on third-party platforms (cloud, hosting, SaaS, CDN), also anything those providers’ policies require, such as notification or prior approval.
• Your employer’s or client’s systems only if you have that authority from them, not merely access.

Every scan except the free surface scan requires you to verify the domain by DNS record, HTTP file or a work email on the domain. Verification shows you control the domain; it does not authorize you to test other systems that domain points to, and you must not use proxies, redirects, shared hosting tricks or someone else’s domain to get around it.

• Scanning or attacking any system you are not authorized to test, or using HyperSec against people or organizations to harass, extort or damage them.
• Targeting critical infrastructure, government, healthcare or emergency systems unless you operate them or hold written authorization from the operator.
• Denial-of-service or load testing, and any setting intended to overwhelm a target.
• Attacking HyperSec, other HyperSec customers, or the infrastructure we use, or trying to access another organization’s data.
• Using evidence to access, copy, change or delete real users’ data beyond what is needed to prove a finding.
• Circumventing domain verification, plan limits, credits or the free-plan per-domain limits, including through multiple accounts.
• Sharing, reselling or sublicensing access, or exposing your API keys.
• Uploading malware or using the Service for anything unlawful.

• Prefer a staging environment that mirrors production, and take backups before a deep scan of production.
• Tell your hosting provider, security operations team and anyone who monitors the target before you start.
• Set a request rate that your system can take, and use dedicated, least-privilege test accounts for authenticated scans.
• Schedule deep scans for low-traffic windows and watch the first run.
• Treat findings and evidence as confidential: they describe real weaknesses and may contain personal data.

We may pause or stop a scan, suspend or close an account, and preserve and disclose relevant records to affected parties or authorities when we believe this policy was breached or someone is at risk. Breaching it is also a breach of the Terms of Service.

If you believe HyperSec was used to test a system without permission, email [email protected] with the domain, times and any logs. We act on these reports promptly.

If you found a vulnerability in HyperSec itself, please write to the same address and give us a chance to fix it before disclosing it.