These terms apply to your use of xecurelogic.com, which XecureLogic LLC (“XecureLogic,” “we,” “us”) operates.
The short version. The site is information, not professional advice. Contacting us doesn’t make you a client or create any duty of confidentiality, so don’t send secrets through the form. Our research describes what we observed at the time. Our open-source tools are governed by their own licenses. Don’t attack the site; good-faith security research that follows section 9 is welcome.
1. What these terms cover
These terms cover the website and its contact form. Work we do for clients is governed by a separate signed agreement; if that agreement conflicts with these terms, the agreement controls. Our Privacy Policy explains how we handle personal information.
2. Accepting these terms
When you check the box on the contact form, you agree to the version of these terms in effect at that time, and we record which version you accepted. If you don’t agree, please don’t use the contact form; you can email us instead.
3. No client relationship, no confidentiality
Contacting us, through the form or by email, does not by itself create a client relationship or an agreement by XecureLogic to treat the information you send as confidential. An engagement begins only when both parties sign an agreement.
Do not send passwords, credentials, vulnerability details or other confidential information through the contact form. If an engagement requires sensitive information, we will agree on a secure way to exchange it. To report a vulnerability in our own systems, follow our security disclosure page.
4. Information, not professional advice
Everything on this site, including our research, service descriptions and frequently asked questions, is general information. It is not professional advice for your situation, it may be incomplete, and it may become outdated. Don’t rely on it in place of advice from a qualified professional who knows your environment.
5. Security research we publish
Our research articles describe what we observed at a specific time. Domains, IP addresses and other indicators may have changed hands, been cleaned up or been taken down since then. A domain we name may belong to a legitimate owner whose site was compromised; naming it is a statement about what we observed, not an accusation against its owner.
Research is published for defensive purposes. Don’t visit or interact with infrastructure we identify as malicious, and test systems only when you are authorized to do so. If you believe something we published is inaccurate, email info@xecurelogic.com and we will review it.
6. Open-source tools
Your use of each open-source tool is governed by the license in that tool’s repository. If these terms conflict with that license as to the software, the repository license controls.
7. Products in development
Products we describe as in development, such as Kataris, are descriptions of work in progress. They are not commitments about features, timing or availability. A product made available separately may be subject to its own terms and privacy information.
8. Acceptable use
Except as section 9 permits, you may not:
- probe, scan or test the site for vulnerabilities
- attempt to access any system, account or data you are not authorized to access
- interfere with the site, including through denial-of-service or resource exhaustion
- bypass the bot check or rate limits, or submit the contact form automatically or in bulk
- send malicious code or use the contact form to send spam or impersonate someone else
9. Good-faith security research
We welcome reports of vulnerabilities in xecurelogic.com. If you conduct research in good faith, consistent with our security disclosure page and every condition below, we consider that research authorized under these terms, and we will not initiate legal action against you or refer the matter to law enforcement based solely on research that satisfies all of these conditions, except where disclosure or referral is required by law.
The conditions are:
- You test only XecureLogic-controlled functionality exposed through xecurelogic.com. This authorization does not extend to testing Cloudflare, Resend, Proton, GitHub or any other third-party service itself.
- You do not intentionally access, modify or delete data that isn’t yours. If you encounter data that is not yours, you stop testing that path, do not intentionally access, copy, modify or delete any more of it, and tell us in your report.
- You do not establish persistence, perform destructive testing, use social engineering or phishing, or attempt physical access.
- You do not perform denial-of-service or resource-exhaustion testing, or anything else that degrades the site for others.
- You report promptly to security@xecurelogic.com, keep the details confidential, and delete any data you obtained once you have reported.
- You give us at least 90 days to address the issue before disclosing it publicly, unless we agree otherwise in writing, and you never publicly disclose personal information, credentials or other data belonging to another person.
We do not run a bug bounty program, and research is not compensated. This section does not authorize anything that is unlawful, and it cannot bind third parties.
10. Our content
The content of this site, including text, images and design, belongs to XecureLogic LLC or its licensors. You may link to our pages, and you may quote short excerpts with attribution and a link to the source. Don’t republish entire articles or present our work as your own. “XecureLogic” and our logo are our trademarks.
11. Links to other sites
The site links to sites we don’t control, including sources, GitHub and LinkedIn. We are not responsible for their content or practices. Research articles may identify domains observed in connection with malicious activity; don’t visit or interact with them based on their appearance in our research.
12. Disclaimer
Except for commitments expressly made in our Privacy Policy or in a signed engagement agreement, and to the fullest extent permitted by law, the site and its general informational content are provided “as is” and “as available,” without warranties of any kind, express or implied, including warranties of accuracy, fitness for a particular purpose and non-infringement.
13. Limitation of liability
To the fullest extent permitted by law, XecureLogic will not be liable for any indirect, incidental, special or consequential damages, or for lost profits or data, arising from your use of the site or its content. To the same extent, our total liability arising from your use of the site will not exceed $100.
Nothing in these terms limits liability for fraud, willful injury, gross negligence, violation of law, or anything else that cannot be limited under applicable law.
14. Governing law and venue
These terms are governed by the laws of the State of California, without regard to its conflict-of-law rules. Any dispute arising from these terms or the site will be heard in the state courts located in Los Angeles County, California, or the United States District Court for the Central District of California.
15. Changes to these terms
When we change these terms, we post the new version with a new effective date. Changes apply only from that date. The version you accepted when you submitted the contact form continues to apply to that submission.
16. General
If any part of these terms is found unenforceable, the rest remains in effect. Our not enforcing a provision is not a waiver of it.
17. Contact
Questions about these terms: info@xecurelogic.com. Vulnerability reports: security@xecurelogic.com. Privacy: privacy@xecurelogic.com.