Acceptable use policy

You may add a site to Hardn only if you, or the organisation you act for, own or operate it, or you hold written permission from its owner to test it. Permission must cover automated security scanning.

If you scan for a client, you're responsible for having their permission and for keeping it current. If that permission ends, delete the site from Hardn.

• No site is scanned until its ownership is proved by a DNS TXT record or a file on the site.
• Ownership is re-checked before every scan, including scheduled scans.
• Scans stay on the verified host, are read-only, and are rate-limited.
• Private, internal and cloud-metadata addresses are always refused.

• Verifying or scanning a site you aren't authorised to test, or helping someone else do so.
• Tricking the verification step, for example by taking over a DNS record or hosting space you don't control.
• Using Hardn, its reports or its API to attack, disrupt or gain access to any system.
• Supplying test accounts that belong to real people rather than test identities you control.
• Trying to get around Hardn's scope, rate or safety limits, or probing Hardn's own infrastructure.
• Reselling scan results about third parties, or using Hardn in breach of Australian law, including the Criminal Code Act 1995 (Cth) and state computer-offence laws.

Some hosting and cloud providers set their own rules for testing sites on their platforms. Hardn scans only your application, read-only, but you're responsible for following your provider's policy.

We may stop scans, remove sites, suspend or close accounts, and keep the records we need. Where the law requires it, or to protect others, we may report misuse to the affected owner or to authorities.

If you believe Hardn has scanned your site without your permission, email support@hardn.si with the address and the time. We'll investigate and, where appropriate, block the site from further scans.