Acceptable Use Policy

Public website-quality scans may inspect publicly accessible pages without ownership or permission from the site owner, subject to this policy. Private, authenticated, and owner-depth scans require verified domain ownership and authorization to perform the checks.

• the U.S. Computer Fraud and Abuse Act (18 U.S.C. § 1030);
• the U.K. Computer Misuse Act 1990;
• the EU NIS2 Directive (Directive 2022/2555);
• state-level computer-trespass laws;
• and similar laws in other jurisdictions.

You are responsible for complying with applicable law and site restrictions. Domain verification proves technical control, not legal or contractual authority to test private routes or third-party services.

Passive scans render publicly accessible pages and inspect website quality. Site ownership is not required, but the prohibitions in §3 still apply.

Owner-depth scans run only against verified hostnames and may use an owner-provided header to crawl private pages. Use a least-privileged test account, avoid destructive workflows, and remove the header after the scan if you issued it only for FixWeb.

You will not use FixWeb against any of the following, regardless of mode:

• government, military, intelligence, law-enforcement, or critical-infrastructure systems you do not own;
• healthcare, banking, payment-processor, or election systems you do not own;
• systems publishing a /.well-known/security.txt with policies that exclude automated testing;
• systems whose terms of service prohibit automated scanning;
• systems controlled by a person or entity to which you are subject to a non-compete, non-disclosure, or similar restriction inconsistent with testing;
• systems located in any jurisdiction subject to comprehensive U.S. or EU sanctions (currently Cuba, Iran, North Korea, Syria, and the Crimea, DNR, and LNR regions of Ukraine);
• private or authenticated systems you neither own nor have written authorization to test.

You will not, and will not permit any other person to:

• circumvent the domain-verification flow or our rate limits;
• use FixWeb to facilitate unauthorized access, denial of service, data exfiltration, ransomware deployment, or any other criminal act;
• resell, sub-license, or repackage FixWeb's output as your own service without our written consent;
• scrape, mirror, or systematically extract data from FixWeb;
• reverse-engineer, decompile, or attempt to derive the source code of our scanner, except to the extent expressly permitted by mandatory law;
• upload viruses, worms, or other malicious code intended to disrupt FixWeb;
• impersonate any person or entity, or misrepresent your affiliation;
• use FixWeb to harass, defame, or threaten any person.

We read robots.txt and report what it says, but a check-up may open pages that robots.txt asks search engines to skip. A check-up checks up to 50 pages and paces its requests; it does not promise a fixed requests-per-second rate. We identify ourselves with a FixWebScanner/1.0 (+https://fixweb.app/bot) User-Agent. Owner-depth scans are restricted to verified domains and should use safe test-account context.

To report abusive scanning of a site you operate, contact support@fixweb.app with details (target hostname, approximate time, request signature). We log every scan with the originating user, IP address, target, and timestamps. We cooperate with valid legal process and will respond to verified abuse complaints within five business days.

We may suspend or terminate access without notice for any violation of this policy. Repeat violations result in permanent termination and may be reported to law enforcement. We reserve the right to preserve scan logs, account metadata, and IP information for as long as reasonably necessary to support a response to law-enforcement requests.

FixWeb is operated by EGO HERO LLC. For acceptable-use questions, write to support@fixweb.app.