Rules of Engagement

1. Authorization is required

A Check is active security testing. We begin only after you provide written authorization: you confirm that you own the targets in scope or are authorized by their owner to have them tested, you name the exact scope, and you accept these Rules. We record that authorization (who, what, when) as evidence of consent and keep it for the duration required by law. If you cannot give that authorization, we cannot test the target.

2. Scope

We test only the domains, hosts and applications you list when you authorize the assessment, plus the subdomains and services that belong to them and are discovered during recon. We do not test anything outside that scope. If discovery turns up assets that may not be yours, we check with you before touching them. You can change or narrow the scope at any time before testing completes.

3. How we test

Testing is external and non-destructive. We perform reconnaissance (subdomains, DNS, ports and services), TLS and HTTP analysis, technology fingerprinting and a vulnerability scan (Nuclei and OpenVAS). On the App Pen Test tier we additionally attempt to confirm exploitable findings in a controlled, minimal way — only far enough to prove impact, never to cause damage, exfiltrate real data at scale, or disrupt your service. We do not run denial-of-service or load testing, do not alter or delete your data, and do not pivot beyond the authorized scope.

4. Timing and disruption

Testing is designed to stay well within normal traffic levels. If you need a specific window or need to exclude a fragile system, tell us in your scope notes. In the unlikely event our testing appears to affect your service, we pause immediately. You can tell us to stop at any time, for any reason, and we will.

5. Critical findings

If we find something critical — for example an exposed database, an actively exploited vulnerability, or exposed credentials — we tell you as soon as we confirm it, before the final report, so you can act. We do not disclose your findings to anyone else.

6. Third-party platforms

If your targets are hosted on a provider (for example a cloud platform or a managed host), their own terms may require you to notify them or request permission before testing. Making sure any such provider authorization is in place is your responsibility; we are happy to tell you what we plan to run.

7. Your data

We handle any data we encounter as confidential, collect only what's needed to demonstrate a finding, and store assessment results securely. Reports and evidence are shared only with you. See the Privacy Policy.

8. What an assessment is not

An external assessment reflects what is reachable and testable from the internet within the agreed scope at the time of the scan. It cannot prove that no vulnerability exists, and it does not replace a continuous program or formal certification. Fixing the findings, and verifying the fixes, remains your responsibility — the App Pen Test tier includes one retest to help.

9. Contact

Questions about scope or conduct: hello@riskbits.net. Ionuț-Robert Sandu, Persoană Fizică Autorizată (PFA), CUI 51596898, B-dul Bucureștii Noi 136, parter, ap. 5, Sector 1, Bucharest, Romania.