Terms of Service

1. Introduction

Cipherline LLC (“Company”, “we”, “us”, “our”) operates the XploitScan security scanning platform available at xploitscan.com and through our CLI tool, GitHub Action, GitHub App, VS Code extension, MCP server, and API (collectively, the “Service”). These Terms of Service (“Terms”) govern your use of the Service. By accessing or using the Service, you agree to be bound by these Terms. If you do not agree to these Terms, please do not use the Service. Our Privacy Policy explains how we handle your data and is incorporated into these Terms by reference.

2. Service Description

XploitScan is a security scanning tool designed to identify vulnerabilities in AI-generated and human-written code. The Service analyzes your code for common security issues, provides plain-English explanations of findings, maps findings to compliance frameworks, and offers fix suggestions. XploitScan can be used via our web interface, our CLI tool (npx xploitscan scan .), our GitHub Action for CI/CD integration, our API, and our Model Context Protocol (MCP) server for AI coding agents. The Service also includes a Free Trust Page builder that lets any visitor publish a public security overview at xploitscan.com/t/<slug>. Specific terms for the Free Trust Page builder and the MCP server appear in sections 10 and 11 below.

Compliance Mapping Disclaimer: The compliance mapping feature is provided for informational and educational purposes only. It maps scan findings to relevant compliance framework controls but does not constitute a compliance audit, certification, or legal opinion. Achieving compliance with SOC2, ISO 27001, or any other framework requires comprehensive organizational controls beyond code scanning. You should consult qualified compliance professionals for formal compliance assessments.

AI Disclaimer: XploitScan uses artificial intelligence to analyze code, detect vulnerabilities, filter false positives and generate fix suggestions. AI-generated results, explanations, and fix suggestions may contain errors, omissions, or inaccuracies. Fix suggestions are starting points, not drop-in solutions — an AI-suggested fix may be incomplete, context-dependent, or may itself introduce new vulnerabilities if applied without review. You are solely responsible for independently verifying all findings and reviewing all suggested fixes before applying them to any codebase, especially production systems. The Service is not a substitute for human security expertise, professional code review, penetration testing, or legal advice.

3. Accounts and Authentication

To use certain features of the Service, you must create an account. We use Clerk as our authentication provider. When you create an account, you agree to:

• Provide accurate and complete information
• Keep your login credentials secure
• Notify us immediately of any unauthorized access to your account
• Accept responsibility for all activity that occurs under your account

You may authenticate using email, social logins, or other methods supported by Clerk. We are not responsible for Clerk’s availability or security practices, though we have selected them as a trusted provider.

4. Plans, Pricing, and Billing

XploitScan offers the following plans:

• Free Plan: Limited scans per day with core security rules. No credit card required.
• Pro Plan: Unlimited scans, all available security rules, PDF reports, compliance mapping, webhook integrations, and priority support. Available with monthly or annual billing. New subscribers get a 7-day free trial (one trial per customer; not available if you have had an XploitScan trial or paid subscription before).
• Team Plan: Everything in Pro, plus team seats, shared scan history, role-based access control, and team management. Available as a self-serve monthly or annual subscription at the price shown on our pricing page, purchased and auto-renewing the same way as Pro. New subscribers get a 7-day free trial (one trial per customer; not available if you have had an XploitScan trial or paid subscription before).

Current pricing is listed on our pricing page.

Paid subscriptions are processed through Stripe. One free trial per person — if you have previously subscribed to any plan (Pro or Team), or a free trial has already been started with your email address or payment card on any account, including a deleted one, new subscriptions will begin billing immediately without a trial period, regardless of which plan you select. If a trial starts with a payment card that has already been used for one, we end that trial and charge the card straight away; if that charge is declined, the subscription is canceled. At the end of your trial period, your payment method will be automatically charged the applicable rate (monthly or annual) unless you cancel before the trial ends.

Paid plans renew automatically at the end of each billing period (monthly or annual, as you selected) and we charge your payment method on file at the then-current price (we'll give you notice of any price change as described below) until you cancel. You can cancel anytime online in Settings > Billing > Manage Subscription; cancellation takes effect at the end of the current billing period and you keep access until then. Except for the 14-day first-annual-purchase refund below or where required by law, fees already paid are non-refundable. Only the account holder, or the team owner on a Team plan, can cancel.

In countries where our checkout asks for a tax ID (such as EU countries, the UK, Canada, Australia and Switzerland), paid plans are sold only to businesses, and you must enter your business tax ID to subscribe. By entering it, you confirm you are buying for your business, not as a consumer. If you subscribed before November 4, 2026, any right to withdraw that applied when you subscribed still applies. Nothing in these Terms limits any right you have by law that cannot be waived.

You may request a full refund of your first annual plan purchase within 14 days of that charge by emailing admin@xploitscan.com. This applies only to the first annual purchase, never to a renewal, and only once per customer — the same reuse rule as the free trial (your account, email, or payment card, including a deleted account). A refund ends paid access immediately and your account returns to the Free plan. There is no self-serve refund; we may refuse repeat or bad-faith requests.

Founding rate: if you start an annual Pro or Team subscription between Nov 2 and Nov 30, 2026, including with a free trial, you can get the founding rate. Switching an existing monthly Pro or Team subscription to annual billing, in your account settings or the billing portal, does not qualify. A founding seat is secured when your first annual payment succeeds, if seats remain at that moment; a free trial does not hold a seat. If your first payment after a free trial fails or needs extra verification from your bank, a successful payment within 7 days of that first attempt still counts, but no seat is held in the meantime; after that, the founding rate does not apply even if a later payment succeeds. Without a free trial, your first payment is taken at checkout; if it does not complete, you will need to check out again, and a seat is secured only if seats remain at that time. If your trial started in that period, its first payment can still secure a seat after Nov 30 while seats remain. Once secured, your annual price stays at $119 (Pro) or $699 (Team) for as long as that subscription keeps renewing without a break. If no seat is secured, your subscription continues at the standard annual price, which may change with notice as described in this section. The founding rate ends if you cancel, let the subscription lapse, or switch plan or billing interval. Taxes may apply. Limited to 20 Pro and 5 Team subscriptions.

Plan Changes: You may upgrade or downgrade your plan or switch between monthly and annual billing at any time through your account settings. Plan changes take effect immediately. When switching plans or billing intervals, charges are prorated: you will receive credit for the unused portion of your current billing period and be charged for the new plan at the prorated rate.

Team Plan: Team members invited by a Team plan owner receive Pro-level access at no additional cost (up to the included seat limit). The team owner is solely responsible for billing and subscription management. Team members do not need their own paid subscription. If a team owner moves from Team to another plan, all team members immediately lose their inherited access and are reverted to the Free plan. If the owner cancels, members keep access until the subscription ends, which is normally the end of the current billing period.

Taxes: Prices on our pricing page don't include taxes. Any applicable tax, such as Connecticut sales tax, is calculated from your billing address and added at checkout before you pay. Where reverse-charge rules apply to a business purchase, we don't charge VAT or GST, and you account for it yourself. You are responsible for any other taxes related to your use of the Service.

We reserve the right to change our pricing with 30 days’ advance notice. Price changes will not affect your current billing period.

5. Referral Program

XploitScan offers a referral program that allows you to invite others to the Service. By participating in the referral program, you agree to the following:

• The referral program is available only to users with active Pro or Team subscriptions who are team owners or admins
• Each eligible user receives a unique referral code that can be shared
• When a new user signs up using your referral link and subscribes to a paid plan, you receive a credit equal to one month of your current plan, applied to your next invoice via Stripe balance credit
• Referral rewards are at the sole discretion of Cipherline LLC and may be modified or discontinued at any time
• Self-referrals, fake accounts, or any form of referral fraud will result in disqualification and may lead to account termination
• Referral links may not be distributed through spam, unsolicited messages, or any deceptive means

6. Data Retention

We keep your data while your account is active. We do not currently delete scan results or shared-checklist data automatically on a schedule. The Privacy Policy describes retention for each kind of data.

• Scan data: Scan results are retained while your account is active, on every plan (Free, Pro and Team). You can delete individual scans at any time.
• Shared checklists: Shared checklist links stop working 30 days after they are created.
• Audit logs: Retained for security and accountability purposes while your account is active, and deleted with your account, except the record of your agreement described below.
• Record of your agreement: When you create an account, we record when you accepted our Terms of Service and Privacy Policy, which versions you accepted, and how you signed up (for example, email, Google, or GitHub). This record does not include your name, email address, or IP address. We keep it while your account exists and for 1 year after you delete your account, so we can show what was agreed if a dispute arises, and then delete it.
• Account deletion: Deleting your account from Settings removes your scans, audit logs, checklists and other account data, with the exceptions described in the Privacy Policy.

7. Acceptable Use

You must be at least 18 years old to use the Service. By using the Service, you represent that you meet this age requirement. You agree not to use the Service to:

• Violate any applicable law or regulation
• Scan code that you do not have the legal right to analyze
• Attempt to reverse-engineer, decompile, or disassemble the Service
• Interfere with or disrupt the Service or its infrastructure
• Use the Service to develop competing products
• Automate access to the Service beyond what our API, CLI tool, and GitHub Action permit
• Use scan results to exploit vulnerabilities in systems you do not own or have authorization to test
• Use the Service to develop malware, exploits, or any tools intended to cause harm
• Upload code containing live production credentials, secrets, or sensitive personal data
• Share, resell, or sublicense access to the Service without authorization
• Circumvent rate limits, scan quotas, or other usage restrictions

8. Intellectual Property

Your Code: You retain full ownership of any code you submit for scanning. XploitScan does not claim any ownership rights over your source code, repositories, or intellectual property. We do not use your code to train models or for any purpose beyond providing the scan results you requested.

Our Service: The XploitScan platform, including its software, design, branding, documentation, security rules, compliance mappings, and scan analysis algorithms, is owned by Cipherline LLC and protected by intellectual property laws. These Terms do not grant you any rights to our trademarks, logos, or brand assets.

Feedback: If you provide us with suggestions, feature requests, or other feedback about the Service, you grant Cipherline LLC a non-exclusive, royalty-free, perpetual, irrevocable, worldwide license to use, modify, and incorporate that feedback into the Service without any obligation or compensation to you.

9. Code Handling and Data Practices

We take the security of your code seriously. Code you submit for scanning is processed in memory, and the uploaded files are not stored. For signed-in scans we keep the scan results described in our Privacy Policy, such as the name of the scanned folder or repository, scan metadata, and for each finding the rule, severity, affected file path, line number and written fix guidance, together with code-quality findings and AI review decisions with the model's short reasons. Apart from masked previews of detected secrets (no more than the first 6 and last 4 characters), we do not store your code, code excerpts or suggested code changes. For GitHub App pull-request scans we keep only the repository, pull request number, commit, finding counts, file count, scan duration and outcome. Scans run without signing in are not kept unless you sign in from the results page to save them.

10. Free Trust Page Service (User-Generated Content)

The Free Trust Page builder at xploitscan.com/free-trust-page lets any visitor — including those without an XploitScan account — create and publish a public security overview page (each, a “Free Trust Page”) at xploitscan.com/t/<slug>. The following terms apply specifically to that feature.

User-Generated Content. Free Trust Page content (company name, website, policy URLs, security contact, data retention text, incident response text, subprocessors, and self-attested compliance flags) is provided entirely by the creator. XploitScan acts as a passive host. We do not author, edit, endorse, or independently verify any field. We do not confirm that the creator is affiliated with, employed by, or authorized to represent the company named on the page.

Self-Attestation, Not Audit. Compliance flags (SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS) shown on a Free Trust Page are self-attested by the creator. Their presence on a page is not a certification, audit, attestation report, or verification of any kind by XploitScan. The public page displays a clear “Self-Attested · Unverified” label adjacent to compliance content and a “Provided by page creator · Not independently verified” label adjacent to policy and contact content. Visitors should request original compliance reports and verify creator identity directly with the company named on the page before relying on any statement displayed.

Creator Representations. By creating a Free Trust Page, you represent and warrant that: (i) you have the right to publish the information you submit; (ii) you are affiliated with the company named on the page or have its authorization to publish on its behalf; (iii) the information you submit is accurate to the best of your knowledge; and (iv) you will not publish content that infringes the rights of, defames, or impersonates any third party.

Takedown and Removal. XploitScan reserves the right to remove, disable, or modify any Free Trust Page at any time, with or without prior notice to the creator, including but not limited to: pages that impersonate companies or individuals; pages that contain false, misleading, or unlawful statements; pages that infringe third-party rights; pages subject to a credible complaint from a party whose name appears on the page; and pages we determine, in our sole discretion, present a risk to the platform or its users. To report a page, email admin@xploitscan.com with the URL and your concern. We aim to respond to legitimate takedown requests promptly.

License to Display. By publishing a Free Trust Page you grant XploitScan a non-exclusive, royalty-free, worldwide license to host, display, cache, index, and distribute the content of that page through the Service. You retain ownership of the content. You may edit your page or claim it (and thereafter manage it from your account) at any time using the manage URL shown when you create the page (we also email it to the address you provided). A page you have not claimed is kept until you ask us to remove it at admin@xploitscan.com; a page you have claimed is deleted when you delete your account.

11. XploitScan MCP Server

XploitScan publishes a Model Context Protocol (MCP) server (xploitscan-mcp on NPM) that exposes the scanner engine as callable tools inside MCP-compatible AI coding clients (Claude Desktop, Cursor, Windsurf, Continue, Cline, Zed, and similar). The MCP server is distributed separately from the hosted Service under the following terms:

• License. The MCP server is released under the MIT License. The license text is included in the package on NPM.
• Local Execution. The MCP server runs locally, as a process your MCP client starts on your machine, and transmits no telemetry. Without an API key it makes no network calls. If you set XPLOITSCAN_API_KEY, it contacts xploitscan.com to verify your plan and download the paid rules; those requests carry your API key only. Source code submitted to the MCP server never leaves your machine.
• No Warranty. The MCP server is provided “as is” without warranty of any kind, express or implied, including but not limited to merchantability, fitness for a particular purpose, and non-infringement. The Limitation of Liability section below applies to the MCP server to the maximum extent permitted by law.
• Acceptable Use. The acceptable-use restrictions in Section 7 apply to the MCP server. Notably, you must not use the server to scan code you do not have authorization to analyze, to develop competing scanners, or to extract or replicate the underlying rule bank for purposes outside personal or authorized organizational use.
• Updates. We may release updated versions of the MCP server at any time. Older versions remain functional but may lack rules added later or fixes for false positives identified later. We do not guarantee compatibility between major versions.

12. Email Communications

By creating an account, you agree to receive transactional emails related to the Service, including welcome emails, scan completion notifications, team invitations, and billing-related communications. You may manage your email preferences through your account settings to opt out of scan completion alerts, trial reminders and weekly digests; to stop our other non-essential emails, such as onboarding tips and Trust Page review reminders, contact admin@xploitscan.com. You cannot opt out of essential transactional and security-related emails (such as breach notifications and Terms updates).

13. Limitation of Liability

XploitScan is a tool that provides security suggestions and recommendations. It is important to understand that:

• Scan results are suggestions, not guarantees. We do not guarantee that our scans will identify every vulnerability in your code.
• XploitScan is not a substitute for professional security audits, penetration testing, or code review by qualified security engineers.
• Compliance mappings are informational only and do not constitute compliance certification or legal advice.
• We are not liable for any damages, losses, or security incidents that arise from relying on XploitScan scan results or compliance mapping information.
• The Service is provided “as is” and “as available” without warranties of any kind, whether express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

To the maximum extent permitted by law, in no event shall Cipherline LLC be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, business opportunities, or security incidents arising from missed vulnerabilities, regardless of the cause of action or theory of liability. Our total liability for any claims arising from your use of the Service is limited to the amount you paid us in the 12 months preceding the claim, or $100, whichever is greater.

14. Termination

You may stop using the Service and close your account at any time. We may suspend or terminate your access to the Service if:

• You violate these Terms
• You engage in activity that could harm the Service or other users
• We are required to do so by law
• We decide to discontinue the Service (with reasonable notice)

Upon termination, your right to use the Service ends immediately. If you are a Team plan owner, all team members will lose access upon your termination. Any provisions of these Terms that should reasonably survive termination (such as limitation of liability, intellectual property, indemnification, and dispute resolution) will continue to apply.

15. Changes to These Terms

We may update these Terms from time to time. When we make significant changes, we will notify you by email or through the Service and update the “Last updated” date at the top of this page. Your continued use of the Service after changes take effect constitutes acceptance of the updated Terms. We encourage you to review these Terms periodically.

16. Governing Law

These Terms and any disputes arising out of or related to them or the Service shall be governed by and construed in accordance with the laws of the State of Connecticut, USA, without regard to its conflict of law provisions. The courts located in Connecticut shall have exclusive jurisdiction over any disputes arising under these Terms.

17. Dispute Resolution and Class Action Waiver

In the event of any dispute, claim, or controversy arising out of or relating to these Terms or the Service, the parties agree to first attempt to resolve the matter through good-faith negotiation. If the dispute cannot be resolved through negotiation within thirty (30) days, it shall be settled by binding arbitration conducted in the State of Connecticut, in accordance with the rules of the American Arbitration Association. The arbitrator’s decision shall be final and binding on both parties.

CLASS ACTION WAIVER: All claims must be brought in the parties’ individual capacity only, and not as a plaintiff or class member in any purported class, consolidated, or representative proceeding. The arbitrator may not consolidate more than one person’s claims and may not otherwise preside over any form of a representative or class proceeding. You acknowledge that by agreeing to these Terms, you and the Company are each waiving the right to a trial by jury and the right to participate in a class action.

18. Indemnification

You agree to indemnify, defend, and hold harmless Cipherline LLC, its officers, directors, employees, agents, and affiliates from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable attorneys’ fees) arising out of or in connection with your use of the Service, your violation of these Terms, or your violation of any rights of a third party.

19. Force Majeure

Cipherline LLC shall not be liable for any failure or delay in performing its obligations under these Terms where such failure or delay results from circumstances beyond its reasonable control, including but not limited to acts of God, natural disasters, war, terrorism, pandemic, power outages, internet or telecommunications failures, government actions, or failures of third-party service providers (including but not limited to hosting, authentication, payment processing, and email delivery services).

20. Severability

If any provision of these Terms is found to be unenforceable or invalid by a court of competent jurisdiction, that provision shall be limited or eliminated to the minimum extent necessary so that the remaining provisions of these Terms shall remain in full force and effect.

21. Waiver

The failure of Cipherline LLC to enforce any right or provision of these Terms shall not constitute a waiver of such right or provision. Any waiver of any provision of these Terms will be effective only if in writing and signed by Cipherline LLC.

22. Assignment

You may not assign or transfer these Terms, or any rights or obligations hereunder, without the prior written consent of Cipherline LLC. Cipherline LLC may assign these Terms, in whole or in part, without restriction, including in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Subject to the foregoing, these Terms shall bind and inure to the benefit of the parties and their respective successors and permitted assigns.

23. Entire Agreement

These Terms, together with our Privacy Policy, constitute the entire agreement between you and Cipherline LLC regarding your use of the Service and supersede all prior agreements, representations, and understandings.

24. Contact

If you have questions about these Terms, please reach out to Cipherline LLC at admin@xploitscan.com.