Hefes Scan

Rules of engagement

HEFES SCAN — RULES OF ENGAGEMENT AND AUTHORISATION · version 2026-10-17

DRAFT — have this reviewed by a lawyer before taking paying customers.

By adding a domain you confirm that:

  1. You own the domain, or you are explicitly authorised by its owner, and you are authorised to have the systems it resolves to tested. This includes the subdomains beneath it: control of a domain's DNS is control of the names under it. If the domain is hosted by a third party (shared hosting, a CDN, a SaaS platform), you confirm that provider's terms permit external security scanning of your service.
  2. You authorise Hefes LLC to perform automated, NON-INTRUSIVE external testing of the domain, the subdomains beneath it, and the hosts those resolve to, from the published scanner address scanner.hefes.net. Subdomains are discovered from public certificate transparency logs and conventional names, and only those that resolve are tested. Testing is limited to: DNS and port/service discovery, TLS configuration analysis, HTTP security header analysis, review of the site's own content and published component versions, and signature or template-based checks for known vulnerabilities and misconfigurations.
  3. Hefes LLC will NOT: exploit vulnerabilities, attempt to log in or guess credentials, perform denial-of-service or load testing, modify or delete data, or test any system outside the named domain, the names beneath it and the addresses those resolve to.
  4. You understand that even non-intrusive scanning can, rarely, cause fragile systems to misbehave, and that Hefes LLC's liability is limited as set out in the Terms of Service.
  5. You understand that a clean result means no issues were found by the listed automated checks on the stated date. It is not a guarantee that the site is secure.
  6. You can withdraw this authorisation at any time by removing the domain from your account; no further scans will be queued.

This record (version, time, IP address) is stored with the domain for the lifetime of the account.

This page is generated from the plain-text original, which is the record kept against your account.