Acceptable Use Policy
1. Authorization is mandatory
You may only submit a domain, hostname, or URL for scanning if you own it or have explicit written authorization from the owner to test it. Submitting a third-party domain you do not control or have not been authorized to test is a breach of these terms and may violate computer-misuse law in your jurisdiction (e.g. Slovak Criminal Code, EU Directive 2013/40/EU, or the equivalent in your country).
2. What the scanner does
Our scanner performs passive, read-only checks against the target's public-facing HTTP/TLS surface: response headers, TLS/certificate configuration, DNS/security records, and similar externally observable signals. It does not attempt to:
- Authenticate, log in, or bypass access controls
- Submit exploit payloads, fuzz inputs, or attempt injection
- Access non-public paths, admin panels, or restricted content
- Perform denial-of-service, load, or brute-force testing
The scan is comparable in nature to publicly available tools like SSL Labs or Lighthouse - it observes what is already exposed to any visitor's browser.
3. Prohibited uses
- Using scan results, findings, or reports to attack, exploit, extort, or otherwise harm the scanned system or its operator.
- Scanning domains to harass, stalk, or gather intelligence on a person or organization without authorization.
- Reselling, republishing, or redistributing another party's scan results without their consent.
- Using the service to test systems you know or suspect you are not authorized to test.
- Automating bulk submissions to circumvent rate limits or plan quotas.
- Attempting to reverse-engineer, scrape, or abuse the scanning infrastructure itself.
4. Your representations
Each time you submit a domain for scanning, you represent that you own the domain or hold written authorization to test it, and that the scan will not violate any law or third-party agreement. We may require proof of ownership/authorization (e.g. DNS TXT record, a file at a known path, or a signed authorization letter) before running paid or deep scans on request.
5. Enforcement
We reserve the right to suspend or terminate any account, without refund of the affected period beyond what is required by our Refund Policy, for violation of this policy. We may report unlawful activity to relevant authorities.
6. Reporting abuse
If you believe your domain was scanned without authorization, or that this service is being misused, email hello@koscak.ai with details.
7. Related policies
See Terms of Service and Privacy Policy for the full contract governing use of this service.