End User Licence Agreement

“The software” means everything Webcuris provides for you to run or connect to: the hosted web application at webcuris.com, the command-line tool you can download from your account, the MCP server that AI assistants connect to, the API, and the documentation. It also covers the reports, exports and attestations the platform generates from your scans, which are yours to keep and share.

For as long as you hold an account in good standing, we grant you a non-exclusive, non-transferable licence to use the software for your own business or personal purposes, on the plan you have chosen. This includes running the command-line tool on as many of your own machines and CI pipelines as you like, connecting the AI assistants you use, and giving colleagues access through an organisation on plans that include one.

You may operate the service on behalf of clients — an agency scanning the sites it manages, a consultancy assessing a customer's repository — provided you hold the authorisation described below for each target, and on plans that include client reporting you may present the reports under your own name.

The software, its checks, its rule content and its design remain the property of Webcuris and its licensors. This agreement grants you use, not ownership, and every right not expressly granted here is reserved.

Everything you submit and everything the platform produces from it belongs to you: the targets you register, the findings, the scan history, the reports and the exports. We process it only to provide the service, as described in the Privacy Notice, and you can export it or delete it yourself at any time from your account. Reports and exports you download are yours to share with whoever you choose.

Findings quote evidence from the systems you scan. Where you scan a system you operate on behalf of someone else, you are responsible for handling that evidence as their agreement with you requires.

Security testing is lawful when it is authorised, and this licence is granted on that basis. You confirm that every system you scan is one you own, or one whose owner has given you permission to test. The Security Testing Authorisation Policy sets out exactly which checks run on an unverified target and which need proven ownership; the platform enforces that boundary itself, and this agreement asks you to respect it in turn.

The scanner identifies itself to every system it contacts, with a User-Agent that names Webcuris and points to a page explaining what it does. That identification is part of how the service is offered and is not to be altered or disguised.

In using the software you agree not to:

• Scan, probe or otherwise interact with systems you are not authorised to test, directly or through the service as an intermediary.
• Circumvent the ownership verification, the private-address guard, the rate limits, plan limits or any other control built into the service.
• Copy, modify, reverse-engineer or redistribute the software or its rule content, or build a competing product from them, beyond what applicable law expressly permits.
• Share account credentials, API keys or assistant connections with people who are not part of your organisation on the service.
• Present a report as an audit, a certification, a penetration test or a statement of compliance with any standard. Reports are automated assessments, and the reports say so.
• Use the service in a way that interferes with its operation or with other customers' use of it.

The Acceptable Use Policy expands on these points.

Webcuris performs a defined set of automated checks and reports what they observe, with each finding's severity, its confidence, the evidence behind it and a recommended fix. A finding is a precise observation about a specific target at a specific time. A clean result means those checks found nothing on that occasion, and is strongest when read alongside continuous monitoring, which re-checks as things change.

Some classes of weakness — business logic, authorisation flaws, anything that needs an authenticated walk-through of your application — are outside what automated scanning can examine, and the Security Policy lists the boundaries plainly so you can plan around them. Remediation guidance is written to be specific and actionable; it is best applied by an engineer who knows your environment, because a configuration that is right in general can still need adjusting for your architecture. The compliance mappings connect findings to the control identifiers they relate to, to help you organise evidence; they are not an assessment of your compliance status.

The software incorporates open-source components, used under their own licences, which this agreement does not alter. Several checks draw on external data sources — vulnerability advisories, exploit-prediction scores, certificate-transparency logs and package registries, each named on the Subprocessors page. Those sources are maintained by others, and a result that depends on them reflects their state at the time of the scan.

The service is improved continuously. Checks are added, rules are refined and the command-line tool is updated; changes that affect how results are read are recorded in the changelog. The tool you download is always the version that matches the service, so re-downloading it is the only update step there is. We work to keep the service available at all times and communicate maintenance in advance where we can.

We warrant that the software will perform the checks described in the documentation with reasonable skill and care. Because no automated assessment can find every weakness, the software is otherwise provided as is, and we do not warrant that it will identify every vulnerability in a system, that every finding will be accurate, or that a target it reports as clean is free of risk.

To the fullest extent permitted by law, our total liability arising out of or in connection with this agreement is limited to the amount you paid for the service in the twelve months before the claim, and we are not liable for indirect or consequential loss, including loss arising from a weakness the software did not detect, from action taken on a finding, or from scanning a system you were not authorised to scan. Nothing in this agreement limits liability that cannot be limited under applicable law.

This agreement lasts as long as you hold an account. You may end it at any time by deleting your account, which removes your data as the Data Retention page describes. We may end it if you materially breach it — in particular by testing systems without authorisation — after notice where the circumstances allow. On termination your licence ends; the reports and exports you have already downloaded remain yours, and the sections on results, warranty, liability and general terms continue to apply.

This agreement and the Terms of Service together are the whole agreement between you and Webcuris for the software. If any part of it is found unenforceable, the rest remains in effect. It is governed by the law and forum stated in the Terms of Service. We may update it as the service evolves; the date at the top records the current version, and material changes are announced before they take effect. Questions about it are welcome through the contact page.