Authorized use policy

OpenCyber is a security testing tool. It sends real attack traffic to the target you give it. Use it only where you are allowed to do that. This page says what that means.

What you may test

• Systems you own.
• Systems whose owner has given you written permission that names the target, the kind of testing and the dates.
• Bug bounty programs, inside their published scope and rules.
• Labs, CTF challenges and applications built to be attacked.

What you may not do

• Test a system without its owner's permission.
• Go beyond the scope you agreed with the owner.
• Try to take a service down or degrade it for its users.
• Copy, change or delete data beyond the minimum needed to prove a finding.
• Use what you find to harm the owner, their users or anyone else.
• Test third-party services your target depends on, such as its hosting or payment provider, unless that provider's own policy allows it.

What you are responsible for

The agent acts on your instructions, and you answer for what it does. Set the scope before you start, watch the run, and stop it if it leaves that scope. Follow the law where you are and where the target is. If the audit exposes personal or confidential data, keep it private and report it to the owner.

Managed audits

Before we run an audit for you, we ask for signed authorization from the owner of the system. We do not start without it.

What OpenCyber does not promise

OpenCyber does not find every vulnerability. A report with no findings does not mean the system is secure. The software comes as is, with no warranty.

Report misuse

If someone has used OpenCyber against a system of yours without permission, write to hello@opencyber.tech.