End User Licence Agreement

You may run, copy, modify and deploy this software for your own use, including commercially, subject to the conditions below. You may operate it on behalf of clients. You may fork it and keep your changes private.

The licence is conditional on the security-testing boundary being respected. Specifically:

• You will only run active checks against systems you own or have documented authorization to test. See the Security Testing Authorization Policy.
• You will not remove or bypass the ownership-verification gate, the private-address guard, the rate limits, or the emergency stop. Those exist to keep the software on the right side of a legal line, and a build with them removed is not covered by this licence.
• If you redistribute a modified version, you will not represent it as having capabilities, certifications or assurances it does not have. The honesty of the claims is part of what is being licensed.

• Use it to test, probe or attack systems you are not authorized to test — including using it as a proxy to reach systems indirectly.
• Represent its output as an audit, a certification, a penetration test, or evidence of compliance with any standard. It is none of those. See the Security Policy for what the findings actually are.
• Remove the attribution in the scanner’s User-Agent, or otherwise configure it to disguise what it is. Targets are entitled to know what is requesting from them.

The software is provided as is, without warranty of any kind, express or implied, including fitness for a particular purpose and non-infringement.

Specifically, and in plain terms:

• It will miss things. A clean scan is evidence that these particular checks found nothing, and is not evidence that a system is secure. Whole classes of vulnerability — business logic, authorization flaws, anything requiring authenticated interaction — are outside what it examines at all.
• It will sometimes be wrong. Pattern-matching findings are labelled by confidence for that reason, and a finding’s confidence is part of the finding.
• Third-party data may be stale or unavailable. Vulnerability advisories, exploit-prediction scores and certificate transparency logs come from external services that can be out of date or unreachable.

The remediation guidance in this product is written to be specific and useful, and it is general-purpose: it does not know your architecture, your threat model, or your obligations. Applying a suggested configuration without understanding it can break things or create new problems. Treat it as an informed starting point that a competent engineer reviews, not as instructions to follow.

Nothing in this product or its documentation is legal advice, and the compliance mappings map findings to control identifiers — they do not assess or establish compliance with anything.

To the maximum extent permitted by law, the authors and contributors are not liable for any damages arising from use of this software — including damages from a vulnerability it failed to find, from acting on a finding, from disruption caused by a scan, or from any consequence of scanning a system you were not authorized to scan.

Some jurisdictions do not allow certain exclusions, in which case those exclusions apply only to the extent permitted.

Breaching the conditions in this licence terminates it automatically. You may end it at any time by ceasing use and deleting your copies. The disclaimers and liability limits survive.

This document was written by the people who wrote the software, not by a lawyer. It is intended to be honest and readable rather than exhaustive. If you are deploying this commercially or on behalf of clients, have it reviewed by qualified counsel in your jurisdiction before relying on it. That advice is not boilerplate — security testing sits close enough to computer-misuse law that the wording genuinely matters.