Terms of Service

1. Who we are and accepting these terms

xsec is operated by Andrés Fernández, a natural person (persona natural) doing business as Xtruct, in Bogotá, Colombia, "we" or "us". You can reach us at andresf@xtruct.net.

By creating an account, using the service or paying for a plan you accept these terms. If you use xsec for a company, you confirm that you may accept them on its behalf; "you" then means you and that company. You must be of legal age and able to enter into a contract.

2. What xsec is, and what it is not

xsec is an online software service (SaaS). It runs automated, non-destructive, unauthenticated "black-box" scans of web applications for the risks in the OWASP Top 10 (2025), shows the findings with remediation advice in a dashboard and in downloadable reports, and offers a public security seal for verified sites.

xsec is not a course. It contains no classes, lessons, videos, exams or certificates. Hotmart, the platform through which we sell paid plans, labels its subscription format as a course; what you buy there is access to this online service, nothing else. The plain-language guide to the OWASP Top 10 on this site is free reference material that comes with the service.

3. Accounts, companies and members

• You sign up with an email address and a password. Keep your password secret and tell us at once if you think someone else has used your account.
• Work is organized in companies. The person who creates a company is its owner; owners and admins can invite members by email with a one-time link valid for 7 days, change their roles and remove them.
• Owners and admins are responsible for who they invite and for what members do in the company: adding sites, launching scans, reading reports and paying for plans.
• Keep the information in your account accurate, in particular the sites you add.

4. You may only scan what you own or are authorized to test

Scanning a system without its owner's permission can be illegal (in Colombia, among others, under Ley 1273 de 2009). For that reason xsec has an ownership gate:

• Full scans run only on sites whose ownership has been verified, either with a DNS TXT record (xsec-verify=<token>) or with a file at /.well-known/xsec-verify.txt on the site. If someone else runs the site, an admin can send its owner a verification link (valid 14 days) so the owner can complete the check without an account.
• Passive scans of a site that is not verified can only be started by a company admin, who must state who authorized the test in writing and a reference to that authorization (for example a contract number). They send only the requests an ordinary browser would send, are limited to 5 per company per month, are marked "OWNERSHIP NOT VERIFIED" in every report, and never count towards the seal.

By adding a site and launching a scan you declare that you own it or that its owner has authorized you, in writing, to test it, and that this authorization covers automated scanning from our servers. You alone are responsible for that declaration. A false attestation is a serious breach of these terms. We may ask for proof of the authorization at any time and suspend scans until we receive it.

If you run the xsec command-line tool or CI integration yourself, it does not check ownership: it runs from your own machines and under your sole responsibility.

5. What a scan does

A scan runs from our servers against the public address of your site and behaves like a careful visitor:

• It uses safe HTTP methods only (GET, HEAD, OPTIONS and, in full scans, TRACE). It never submits a form with POST, PUT or DELETE, so it does not create, change or delete anything through your application.
• It never guesses passwords, does not brute-force and does not try to read data out. Injection checks look for a harmless marker reflected in a page or for a database error message; they show that a class of bug exists without exploiting it.
• Every scan has a bounded request budget, limited concurrency, timeouts and a cap on response size. It stays on your site's host name and refuses private, loopback, link-local and cloud-metadata addresses.
• Full scans also request a few well-known paths to check whether sensitive files are exposed (for example /.git or /.env).
• Server-side request forgery (SSRF, part of A01). In full scans the request parameters of your site, and common parameter names on its known routes, receive a link to our out-of-band collector (at most 60 such requests per scan). If your server fetches that link, the vulnerability is confirmed. We record only a random code, the time and the source address of that request; see the Privacy Policy.
• Passive scans skip everything above that a browser would not send: no payloads, no guessed paths, no TRACE and no SSRF probe.

Even safe requests can trigger alarms in a firewall, intrusion-detection system or hosting provider, and add some load. Tell the people who run your infrastructure before you scan, and do not scan systems that cannot take a modest number of ordinary requests. If your application changes state on a GET request, a scan may trigger that change; xsec reports this as a design flaw, but avoiding it is your responsibility.

6. Limits of the service

xsec finds what can be seen from outside, without signing in. It does not test pages behind a login, does not review your source code (SAST) or your dependencies (SCA), and does not replace a manual penetration test, an audit or a certification. Each report says, per OWASP category, what was tested, partly tested or not tested.

No scanner finds every vulnerability. A clean report, a good score or a valid seal do not mean that your site is secure, and reports can contain false positives. Remediation advice is general guidance; you decide what to change in your systems and are responsible for the result.

7. The public security seal

A verified site can show a seal that links to a public page on this site. The seal is valid while the site is verified and its last completed full scan is at most 30 days old and has no high or critical finding. The public page and the badge only say whether the seal is valid or not valid, never why.

The seal states the result of an automated scan; it is not a certification or a guarantee to anyone. Use it only for the site it was issued for, do not alter it, and do not present it as more than it is. We may withdraw a seal that is misused.

8. Plans, prices and payment

• Free: 10 scans per company per month, no payment.
• Team: USD 29 per month, or USD 290 per year (2 months free; up to 12 installments on Hotmart, with the interest Hotmart charges), 100 scans per company per month.
• Business: USD 99 per month, or USD 990 per year (2 months free; up to 12 installments on Hotmart, with the interest Hotmart charges), 1,000 scans per company per month.

On annual billing the scans are still counted per month: an annual plan gives the same scans each month as the monthly one, and unused scans do not carry over.

Paid plans are sold and billed through Hotmart: the checkout, payment methods, receipts, recurring charges, refunds and chargebacks are processed by Hotmart under its own terms and privacy policy, which you accept at its checkout. The price charged is the one Hotmart's checkout shows, including any taxes or currency conversion it applies for your country. We never see or store your card details.

A plan applies to the company whose Upgrade button you used: the link to the checkout carries that company's identifier, and later charges of the same subscription go to the same company. It is not matched by email address. The plan becomes active when Hotmart confirms the payment to us, usually within minutes; if it does not, contact us with your Hotmart purchase code.

Renewal and cancellation. Paid plans renew automatically at the end of each billing period (a month, or a year on annual billing) until cancelled. You can cancel through Hotmart, or ask us to. After a cancellation the paid plan stays active until the end of the period already paid and then the company returns to the free plan. There are no partial refunds for the rest of a period, except under the guarantee below or where the law requires them.

Refunds. Hotmart offers a 7-day guarantee: you can request a refund through Hotmart within 7 days of the purchase. A refund or a chargeback ends the paid plan immediately and the company returns to the free plan.

Changing plans. Moving from Team to Business is a new subscription. Cancel the old one through Hotmart (or ask us to), or both will keep renewing.

Price changes. We may change prices. A new price applies to an existing subscription only from a renewal after we have told you, at least 30 days in advance.

Nothing in these terms limits the rights you have as a consumer under Colombian law (Ley 1480 de 2011) where they apply.

9. Scan quotas

Quotas count the scans a company starts in a calendar month (UTC) and reset at the start of each month. Unused scans do not carry over. Passive scans of unverified sites have their own limit of 5 per month. We may grant extra scans or plans without payment (for example for demos); those grants can expire and do not change these terms.

10. Acceptable use

You agree not to:

• scan, or try to scan, any system you do not own or are not authorized in writing to test;
• get around the ownership gate, for example by verifying a site you do not control or by making a false attestation;
• use xsec to attack, overload or disrupt any system, or as a relay for traffic to third parties;
• attack, probe or overload xsec itself, or try to reach other customers' data (if you find a security issue in xsec, tell us at the contact address and give us time to fix it);
• go around quotas or limits, share accounts to do so, or use the service in breach of the law.

11. Your data and reports

Your sites, scan results and reports are yours. You allow us to store and process them only to provide and secure the service, as described in the Privacy Policy. Reports can include fragments of your site's responses as evidence; keep them confidential. We do not publish scan results: the public seal page shows only valid or not valid.

The xsec software, the xtruct and xsec names, the mark and the seal design belong to xtruct. You may display the seal for a verified site while it is valid, as described above.

12. Availability and changes to the service

We work to keep xsec available and accurate, but the service is provided "as is" and "as available", without a service-level agreement. Scans can fail or be delayed, and we may add, change or remove checks and features as the service evolves.

13. Suspension and termination

You can stop using xsec at any time; cancel any paid subscription through Hotmart. To delete your account or a company, write to us.

We may suspend or close an account, stop scans or withdraw a seal, with notice where reasonable, if you breach these terms (in particular sections 4 and 10), if we receive a credible complaint that a scan was not authorized, if the law or an authority requires it, or to protect the service or third parties. What happens to your data afterwards is described in the Privacy Policy.

14. Liability

To the extent the law allows, we give no warranty that the service will find every vulnerability, be uninterrupted or be fit for a particular purpose, and we are not liable for indirect or consequential damages, lost profits or lost data, for vulnerabilities a scan did not find, or for the consequences of scanning a target you were not authorized to test.

Our total liability for any claim related to the service is limited to the amounts you paid us in the 12 months before the claim. Nothing in these terms excludes liability that cannot be excluded under Colombian law, such as for wilful misconduct or gross negligence.

You will hold us harmless from claims by third parties that arise from scans you launched without authorization or from your breach of these terms.

15. Changes to these terms

We may update these terms. The date at the top shows the current version. We will tell you about significant changes in the dashboard or by email at least 15 days before they apply. If you do not agree, you can stop using the service and cancel your subscription; continuing to use it after the date means you accept the new terms.

16. Governing law and disputes

These terms are governed by the laws of the Republic of Colombia. Any dispute will be heard by the competent courts of Bogotá, Colombia, without prejudice to the rights consumers have to go to the Superintendencia de Industria y Comercio or to the courts of their domicile.

17. Contact

Questions about these terms: andresf@xtruct.net. Andrés Fernández (Xtruct), Bogotá, Colombia.