Acceptable use policy

Who this applies to

This policy applies to everyone who uses Shipwardly, with or without an account, and to everyone working in an account. It forms part of our terms of use.

Only scan sites you may test

You may only scan sites you own or are authorised to test. If you scan a site for a client or employer, you need their permission first.

• A free scan is passive. Our bot reads only what any visitor's browser receives: the homepage, the files it links to and the source maps they name. It does not log in, submit forms or guess at other addresses. How our bot works lists exactly what it fetches.
• A verified scan needs proof of ownership. Deeper checks run only after you prove the domain is yours with a DNS record or a file on the site, and we check that proof again before every verified scan.
• Monitoring a site you have not verified needs your declaration that you own it or are authorised to test it, and the declaration must stay true for as long as the site is monitored.

What you must not do

• Scan a site you do not own and are not authorised to test, or say you are authorised when you are not.
• Use a report, or anything else from Shipwardly, to attack, exploit, break into, overload or harm any site, system or person.
• Try to use a weakness a report describes on a site that is not yours, even to prove it is real.
• Submit scans by automated means, in bulk, or from many addresses or accounts to get around our limits.
• Get around, disable or interfere with our rate limits, the Turnstile check, ownership verification or a site owner's opt-out.
• Attack, overload or probe Shipwardly itself, except as our security policy allows.
• Use Shipwardly to break the law, or to collect information about people.
• Copy, resell or offer Shipwardly or its reports as your own service.

If you find a problem in someone else's site

Sometimes a scan of your own site shows a problem in a service it uses. Tell the owner of that service privately, give them time to fix it, and do not test or use the problem on their systems. Many sites publish how to report a problem in a /.well-known/security.txt file.

What we may do

To protect site owners and our service, we may refuse or stop any scan, block an address or a domain, pause monitoring, and suspend or close an account that breaks this policy. Where it is fair and safe, we tell you why. If the law requires it, or someone may be in danger, we may share what we know with the police or another authority.

For site owners

If you own a site and do not want Shipwardly to scan it, add a DNS TXT record with the value shipwardly-optout to your domain. We check for it before every scan. You can also email us and we will block the domain by hand. How to opt out has the details.

Reporting misuse

If you think someone has used Shipwardly against your site, or broken this policy, email [email protected] with your domain and what you saw. We look into every report.