DRAFT — needs lawyer review. Not in effect. Placeholders in [brackets].
Terms of Service
Last updated: [date] · Operator: [legal entity name, state]
1. The service
VibeCPR provides automated and human-reviewed scans, reports and code fixes for web applications ("Services"). Reports are a point-in-time review and are not a penetration test, audit, or certification. We do not guarantee that your application is free of vulnerabilities or defects.
2. Authorization to scan
You may only submit applications, URLs and repositories that you own or are authorized in writing to test. You represent that you have that authority. Free Vibe Checks are limited to passive checks. Active testing happens only with a signed authorization for a paid engagement. We may refuse or stop any scan.
3. Your code and data
You keep all rights to your code. You grant us a limited license to access, copy and analyze it only to provide the Services. We do not request production secrets or user data. If we encounter them, we will not use them except to report the exposure. Code is deleted within [30] days after delivery unless you ask otherwise.
4. Fixes
Fixes are delivered as pull requests or patches for your review. You decide whether to merge and deploy them and are responsible for testing in your environment.
5. Fees, delivery and refunds
Prices are shown on our pricing page. If a Rescue Report is not delivered within 48 hours of receiving the required access, you may request a full refund. Fix Pack and Sprint scopes are confirmed in writing before work starts. [Refund terms for fixes TBD.]
6. Acceptable use
No scanning third-party systems, no submitting malware, no attempts to attack our infrastructure.
7. Disclaimers and limitation of liability
[To be drafted by counsel. Intended: services provided "as is"; liability capped at fees paid for the specific engagement; no liability for indirect or consequential losses.]
8. Governing law
[State/jurisdiction TBD.]