VFT369 / SCANNER / TERMS

Scanner Terms of Use

Version 2026-10-12 · Effective 12 October 2026 · Operated by VFT Engineering (vft369.com), South Africa

1. Agreement

1. These Terms govern your use of the VFT369 Website Security Scanner (the "Scanner"), including the web form at vft369.com/#scan, the /api/scan endpoint, reports and any account. They add to the general Terms of Service; where they conflict, these Terms apply to the Scanner.
2. You accept these Terms each time you tick the authorisation box or send "terms" with an API request. The version you accepted is stored with every scan. If you do not agree, do not use the Scanner.
3. You must be at least 18 years old. If you use the Scanner for an organisation, you confirm you may bind it to these Terms, and "you" includes that organisation.

2. Authorisation to scan

1. You may only submit a website, domain or address (a "Target") that you own or control, or for which you hold the express, prior, written authorisation of its owner to perform security testing.
2. By submitting a Target you warrant that this is true at the time of the scan. You must keep proof of your authorisation and provide it to us on request.
3. Domain verification (DNS or file) for full scans is a safeguard we apply; it does not replace your obligation to be authorised, and passing it does not make an unauthorised scan lawful.

3. You are responsible for your scans

1. The Scanner acts only on your instruction. You are the person who selects the Target and directs the scan, and you are solely responsible for that choice and its consequences, including any breach of law or of a third party's rights.
2. VFT Engineering provides an automated tool and does not choose, approve or review Targets before a scan. We do not act as your agent and do not give the authorisation required by section 2.
3. Scanning a system without authorisation may be an offence under South African law, including the Cybercrimes Act 19 of 2020, and under the laws of the Target's country.

4. Acceptable use

You must not:

• scan any Target you are not authorised to scan under section 2;
• use the Scanner, or its results, to attack, disrupt, extort or gain unauthorised access to any system;
• get around rate limits, verification or blocks, including by using several accounts, networks or automation;
• give false information, including another person's email address;
• resell, white-label or offer the Scanner or its results as a service without our written agreement;
• copy, reverse engineer or interfere with the Scanner or the vft369.com website.

5. Logging, investigation and disclosure

1. For every scan we record your IP address, approximate country, browser details, email address, account (if signed in), the Target, the time, the result, your authorisation confirmation and the versions of these Terms and of the privacy notice you accepted. Details are in the privacy policy.
2. We use these records to prevent and investigate misuse and to identify the person who directed a scan.
3. If we reasonably believe a scan was unauthorised or unlawful, we may share the relevant records with the owner of the Target, our service providers, and law enforcement or a regulator, and we will do so where the law requires it. This processing is in line with the Protection of Personal Information Act 4 of 2013.

6. What the Scanner is, and is not

1. The Scanner performs automated, non-intrusive checks of a website's public configuration: TLS and certificates, HTTPS redirection, security headers, cookie flags, version disclosure and, for verified owners, a short list of commonly exposed files. It sends ordinary web requests only.
2. It is not a penetration test. It does not test for application vulnerabilities such as SQL injection or cross-site scripting, does not log in and does not attempt exploitation.
3. Results are provided "as is". Automated checks can miss issues (false negatives) or report issues that do not apply (false positives). A good grade does not mean a site is secure. Use the results as one input and have important decisions reviewed by a qualified professional.

7. Indemnity

You indemnify VFT Engineering, its owner and contractors, and hold them harmless, against all claims, losses, damages, fines, penalties and costs (including reasonable legal costs) brought by any third party or authority that arise from (a) a scan you directed, (b) your breach of these Terms, in particular section 2 or 4, or (c) your use of the Scanner's results.

8. Limitation of liability

1. To the fullest extent the law allows, VFT Engineering is not liable for any indirect, special or consequential loss, loss of profit, data or business, or for any loss arising from a security incident at a site that was scanned, whether or not the Scanner reported an issue.
2. Our total liability for anything relating to the Scanner is limited to the amount you paid us for the Scanner in the 12 months before the claim, or R500 if you have not paid anything.
3. Nothing in these Terms limits liability that cannot lawfully be limited, including under the Consumer Protection Act 68 of 2008 where it applies, or liability for gross negligence or fraud.

9. Suspension and blocking

We may refuse, rate-limit, suspend or block any scan, account, network or Target at any time, without notice, including where we suspect misuse. Website owners who do not want their site scanned can ask us to block it via the contact page.

10. Beta service and changes

1. The Scanner is a beta service. Features, limits and availability may change or stop at any time.
2. We may update these Terms. The new version applies to scans made after it is published, and the scan form will ask you to accept it.

11. Law and disputes

These Terms are governed by the laws of the Republic of South Africa, and the South African courts have jurisdiction. If any part of these Terms is unenforceable, the rest still applies.

12. Contact

Questions, abuse reports and block requests: the contact page, or see security.txt.