Scan Authorization Agreement
The required authorization and safety attestation for each scan.
1. Your authority
By approving a scan, you represent that you own the target or have express permission from a person legally able to authorize the selected testing. You will produce that permission if reasonably requested. Authorization is limited to the exact hostnames and subdomains displayed by the runner.
2. Approved activity
For the MVP safe scan, you authorize bounded GET, HEAD, and OPTIONS requests; limited crawling; TLS, DNS, header, cookie, CORS, redirect, public-file, source-map, JavaScript, mixed-content, and related passive or non-destructive checks; and the locally displayed request, response-size, depth, concurrency, and time ceilings.
3. Activity not authorized by this agreement
This agreement does not authorize login attempts, credential attacks, form submissions, file uploads, modification, deletion, persistence, denial-of-service, destructive testing, automatic exploitation, off-scope redirects, private-network access, or any check the runner does not explicitly display. A future deep scan requires separate control verification and approval.
4. Network authorization
You authorize traffic from the public egress IP shown by the runner and confirm you may use the selected direct connection, VPN, or proxy for this purpose. You understand that target logs may record that address and the scanner user agent. You will not use network routing to conceal unauthorized activity or evade a block.
5. Operational safeguards
You have reviewed the target, resolved addresses, methods, limits, expected duration, and egress path. You will monitor the scan, cancel it if instability or unexpected behavior occurs, and avoid scanning during a sensitive operational window unless specifically approved.
6. Evidence and reporting
You authorize local collection of the minimum evidence needed for findings. Optional cloud synchronization is limited to normalized findings and redacted evidence you choose to upload. You will handle reports as potentially sensitive security information.
7. No transfer of legal responsibility
VibeSIEM Scan supplies a tool and local safeguards but does not determine whether you have legal authority. Your attestation does not bind a target owner who did not authorize you. If authority is uncertain, do not scan and obtain written permission or legal advice first.
8. Required recorded acceptance
The runner must record the scan identifier, runner and ruleset versions, approved scope, selected network path, displayed limits, and acceptance time. The production runner must require an unchecked, affirmative confirmation immediately before execution.