DRAFT — needs lawyer review. Not in effect. Placeholders in [brackets].

Terms of Service

Last updated: [date] · Operator: [legal entity name, state]

1. The service

VibeCPR provides automated and human-reviewed scans, reports and code fixes for web applications ("Services"). Reports are a point-in-time review and are not a penetration test, audit, or certification. We do not guarantee that your application is free of vulnerabilities or defects.

2. Authorization to scan

You may only submit applications, URLs and repositories that you own or are authorized in writing to test. You represent that you have that authority. Free Vibe Checks are limited to passive checks. Active testing happens only with a signed authorization for a paid engagement. We may refuse or stop any scan.

3. Your code and data

You keep all rights to your code. You grant us a limited license to access, copy and analyze it only to provide the Services. We do not request production secrets or user data. If we encounter them, we will not use them except to report the exposure. Code is deleted within [30] days after delivery unless you ask otherwise.

4. Fixes

Fixes are delivered as pull requests or patches for your review. You decide whether to merge and deploy them and are responsible for testing in your environment.

5. Fees, delivery and refunds

Prices are shown on our pricing page. If a Rescue Report is not delivered within 48 hours of receiving the required access, you may request a full refund. Fix Pack and Sprint scopes are confirmed in writing before work starts. [Refund terms for fixes TBD.]

6. Acceptable use

No scanning third-party systems, no submitting malware, no attempts to attack our infrastructure.

7. Disclaimers and limitation of liability

[To be drafted by counsel. Intended: services provided "as is"; liability capped at fees paid for the specific engagement; no liability for indirect or consequential losses.]

8. Governing law

[State/jurisdiction TBD.]

9. Contact

[Contact address TBD at launch.]