1. The service
Assay fetches a web app you point us at, inspects what it already serves to browsers (its pages, its JavaScript bundles, its response headers) and runs bounded, read-only checks for common security problems — exposed keys, an open database, missing protections. It then explains what it found in plain language and, where it can, gives you the exact change to make. Assay is a best-effort detection tool, not a guarantee.
2. Your account
You sign in with GitHub. You’re responsible for activity under your account and for keeping your login secure. You must be old enough to form a binding contract in your jurisdiction.
3. Scan only what you own
You may submit a URL for scanning onlyif you own the app or are explicitly authorized to test it. Scanning apps you don’t control may be illegal and is a breach of these terms. Our Acceptable Use Policy is part of this agreement; read it.
4. No security guarantee
A passing result (“Certified” or the hallmark) means Assay did not find the specific issues it checks for at the time of the scan. It is nota warranty that your app is secure, and it is not a substitute for a professional security audit. Apps change; verification ages. New issues can appear that Assay does not check for. You remain responsible for your app’s security. Assay is provided “as is,” without warranties of any kind.
5. Plans and billing
Assay has a free tier and paid plans. Paid plans are billed monthly in advance through Stripe and renew until you cancel. You can cancel any time from your billing page; access continues until the end of the paid period. Fees are non-refundable except where required by law. We may change prices with notice for future billing periods.
6. Acceptable use & limits
Don’t abuse the service: no scanning of apps you don’t own, no attempts to overload or circumvent rate limits, no use of Assay to attack or exploit any system. We rate-limit and meter scans, and we may suspend accounts that break these rules.
7. Limitation of liability
To the maximum extent permitted by law, Assay and its operators aren’t liable for indirect, incidental, or consequential damages, or for any loss arising from a security issue Assay did not detect. Our total liability for any claim is limited to the amount you paid us in the three months before the claim.
8. Termination
You can stop using Assay and delete your account at any time. We may suspend or terminate access for breach of these terms. Sections that by their nature should survive termination (disclaimers, liability limits) will survive.
9. Changes
We may update these terms; we’ll change the date above and, for material changes, give reasonable notice. Continued use after a change means you accept the updated terms.
10. Contact & governing law
Assay is operated by [legal entity] and these terms are governed by the laws of [jurisdiction]. Questions go to hello@assay.dev.