Legal
DAST Authorization & Safe Harbor Agreement
Effective Date: October 29, 2026 (Version 2026.2)
1. Authorization Covenant
By starting an active web, API or network scan, a TLS check or a concurrency probe on DVSentry, you confirm that:
- You own the target domain or service, or you are an employee or contractor with the owner's written authority to perform security testing on it.
- The owner knows the test may run against the environment you selected, including production if you chose it.
Resilience (fault-injection) tests are not covered here; they need the separate Resilience Testing Authorization.
2. Testing Constraints & Rate Boundaries
- DVSentry runs a web or network scan only on a domain with a current DNS ownership proof, sends every request only to the target's verified public addresses, and refuses redirects to other hosts.
- Scans are paced to a requests-per-second limit and stop at a request budget.
- Checks use benign test values designed to show that a weakness exists, not to change or destroy data. Some checks, such as authorization tests on state-changing requests that an Admin specifically approved, do send write requests to your application. Any test can have side effects on a fragile system; choose the environment accordingly.
3. Indemnification
You will defend and indemnify DVSentry against third-party claims arising from scans started from your account against targets you were not authorized to test. The Terms of Service, including its limitation of liability, apply.