Scan terms

Authorization

You may only request scans of domains you own or have express authorization to test. If a third party operates the site, that authorization must come from them. You are responsible for this statement being true.

What we do

We run an external, automated analysis, as someone on the internet would see it. We do not access your code or internal infrastructure.

What we do not do

Our scan policy always excludes:

• Denial-of-service attacks.
• Attempts to guess credentials.
• Active testing against production.
• Domains outside the scope you indicate.

Possible effects

A scan sends requests to your site, which may show up in your logs or trigger a firewall. We limit the rate to reduce this, but cannot guarantee it will not happen.

What the results mean

An automated scan does not guarantee a site is secure: it can miss flaws or report false positives. Results do not replace a full audit.

Confidentiality

We treat results as confidential. We only share them with you or whoever you authorize, unless a competent authority orders otherwise.

Misuse

We may reject or stop a scan if we doubt the authorization or detect misuse.

Responsibility

We provide the service with reasonable care. You remain responsible for fixing flaws and for the security of your systems.

Contact

For questions about these terms, write to admin@rhinotests.com. Last updated: November 2, 2026.