Acceptable Use Policy
Effective date:
Eligibility and permission
SecurityFuse is operated by Digital Magnet Corporation for eligible adults acting personally or with authority for an organization.
The temporary Quebec and EU/EEA/UK admission restrictions in the Terms apply to personal and business applicants alike.
Scan only targets you own or have explicit permission to assess within the requested scope.
When website scanning is enabled, Quick will require authorization attestation and an allowance; Deep will additionally require current ownership proof.
Repository assessment, if offered, requires separate grants and processing authorization. Neither a URL nor a company role grants blanket permission.
Access is by invitation and sign-in. Hosted website scanning is not currently enabled, and anonymous scanning is not offered.
Supported boundaries and responsible use
Do not submit unauthorized targets, bypass limits, evade exclusions or use SecurityFuse for abuse, and keep authorization valid throughout scanning.
When enabled, supported website collection will remain inside the exact authorized public HTTPS origin and reject credentials and private or reserved destinations.
Supported collection does not offer authenticated-browser testing, form submissions, mutation requests or active exploitation. Repository assessment does not execute repository code; hosted scanning remains disabled.
Read coverage and uncertainty with results, and review and test repair guidance before implementing changes.
A score, report, recheck or absence of findings does not certify safety or approve an application.
Withdrawing authorization
Withdraw authorization by emailing hello@securityfuse.com. The owner handles requests manually; no automated email-withdrawal mechanism is promised.
Hosted scanning is disabled. For any future permitted assessment, the owner will handle requests to stop work within our control manually; requests already sent cannot be recalled.
A resumed assessment requires fresh authorization and any applicable current ownership proof.
Withdrawal requests concern their stated scope. Unrelated permissions and existing results are handled separately, with results remaining subject to retention and deletion limits.
Abuse reports and target-wide exclusions
The owner monitors security@securityfuse.com for suspected abuse, vulnerability reports and scan opt-out requests.
We aim to acknowledge messages within three business days, meaning Monday to Friday excluding Ontario public holidays, using America/Toronto local time.
That target is not a guarantee of investigation, resolution or completed exclusion within three business days, or a promise of continuous monitoring.
We prioritize credible reports of ongoing unauthorized scanning or immediate harm, without promising a fixed emergency-response time.
Provide enough target information to explain a concern without credentials or unnecessary sensitive evidence.
The owner reviews opt-out requests manually and may ask for a DNS record, website file or other evidence of authority appropriate to the request.
A request concerns only domains or resources for which authority is established, not unrelated resources on shared infrastructure.
Hosted scanning is not enabled. Target-exclusion requests are handled by the owner manually; we do not represent that an automated cross-account exclusion and running-scan stop service is operating.
The owner manually reviews authority before removing a target exclusion.
Suspension, review and restoration
We may pause scans or suspend access for reasonably suspected unauthorized scanning, limit bypass, abuse or threats to the service and explain the reason where appropriate.
Request human review from the owner at hello@securityfuse.com; no fixed appeal-response deadline is promised.
Access may be restored after the issue is resolved and required authorization is valid, while serious or repeated misuse or evasion may lead to permanent termination.
Human review, privacy and deletion request channels remain open after termination, and retention rules continue to apply.
Business and personal responsibility
The narrow business-only indemnity in the Terms addresses third-party claims and reasonable legal costs arising from targets submitted without required permission, subject to its notice, defence, settlement and wrongful-conduct protections.
Personal and hobby users give no indemnity and remain responsible for target permission and their own use and implementation decisions.
Nothing in this policy removes regulatory responsibility or creates immunity for anyone’s own conduct.
Private vulnerability reporting
Report vulnerabilities in SecurityFuse itself privately to security@securityfuse.com; the same three-business-day acknowledgement target applies.
A report or security.txt does not authorize deliberate or continued security testing, which requires separate written permission defining scope and limits.
During beta we offer no bug-bounty reward or safe-harbor commitment.
Customer findings remain confidential, and public use or aggregate research requires a separately reviewed approach and any required permissions.
Policy changes
Material changes follow the notice and fresh-acceptance process in the Terms, without providing new scan authorization.