terms
the deal you accept
when you scan with recon.sh.
plain language. signed at the wizard, not in fine print.
version 1.10, effective 2026-10-09. each scan is governed by the version in force when you start it; each pack by the version in force when you bought it.
who we are
the company behind recon.sh.
recon.sh is operated by PurpleOps Ltd, company no. 516961380, a company registered in israel, at Sokolov 68, Herzliya, israel. "we", "us" and "recon.sh" in these terms mean PurpleOps Ltd. payments are collected by Polar Software, Inc. as merchant of record (see "payment and refunds").
acceptance
who this applies to.
by using recon.sh you agree to these terms. if you are using the service on behalf of a company, you are agreeing on that company's behalf and you represent you have authority to do so. to use the service you must be at least 18 years old, have legal authority to commission security testing against the domain you declare (meaning you own it, operate it under a license that permits testing, or hold written authorization from the entity that does), and not be prohibited by applicable law from using the service. if you cannot meet any of those conditions, do not use the service.
what we do
external, autonomous, non-destructive.
recon.sh runs autonomous, external, non-destructive security testing against the domain you declare. the scan operates from the public internet using external IPs only, the same vantage point as any attacker. traffic may come from a range of IP addresses, including VPN exit nodes, so do not rely on an IP allowlist to recognize us. we have no privileged access to and no inside knowledge of your infrastructure. the scan enumerates publicly reachable assets under your domain and discovered subdomains (per your scope settings), tests web applications, APIs, and exposed services for security weaknesses, optionally authenticates using test credentials you supply, and produces a severity-tiered finding report with reproducible evidence. we do not ask for or accept your source code, and we do not access private repositories, internal networks, or systems unreachable from the public internet. if your app publicly exposes source (for example a misconfigured .git directory or published source maps), that is part of your external attack surface and may show up in findings. it does not perform social engineering. it does not test host-level hardening, kernel configurations, or physical controls. we do not test services your app calls that are not reachable under your declared hostnames. subdomain discovery can reach hostnames you have delegated to a third party (a helpdesk, status page, shop, cdn, or similar). where we identify a discovered subdomain as hosted by a third-party service, we skip active testing of it as a safeguard (we may still flag a dangling subdomain that could be taken over, which is your own exposure). this is a safeguard, not a guarantee: it is your responsibility to turn off subdomain scanning, or to exclude those hostnames where the wizard allows it, unless the provider permits security testing of your account. we rely on your warranty for this.
scope
what the scan covers, and what it doesn't.
the scan covers assets reachable from the public internet under your verified domain. by default this includes subdomains and APIs discovered during the scan. you can turn subdomain and api discovery off in the wizard, and we honor that. we do not currently support per-hostname exclusions; if you need one, turn subdomains off and scan that hostname separately. before each scan we verify that you control the declared domain using a method published at recon.sh/trust. we re-verify at scan-start, every time. a successful initial verification does not authorize future scans without re-verification. your application almost certainly calls services you do not control, and some of your subdomains may be hosted by someone else. do not declare a domain, or leave subdomain discovery on, where that would point us at infrastructure you lack authority to test. if your hosting provider, cdn, or waf requires notice or approval before security testing, obtaining it is your responsibility, and we are not responsible for any action that provider takes against your account as a result of the scan.
non-destructive
non-destructive by design.
the scan is designed and operated to be non-destructive. we do not issue SQL DROP or DELETE statements, delete files, or run rm or equivalent destructive operations. where we probe a state-changing operation we use snapshot-and-restore: state is recorded before and restored after. security testing interacts with live systems and carries inherent risk. we use commercially reasonable efforts to avoid disruption, but we cannot guarantee that testing will never affect a fragile or misconfigured system. you acknowledge and accept that security testing can cause damage - including downtime, slowdowns, data corruption or loss, triggered security alerts, locked or rate-limited accounts, abuse responses from your hosting or other providers, and unintended side effects on fragile or misconfigured systems - and you commission the scan with that risk in mind. you are responsible for keeping current backups and for running the scan against systems you can restore. except for the liability that applicable law does not let us exclude (see disclaimers), you assume this risk and we are not liable for that damage. for authenticated testing, we use only the test credentials you supply. we do not forge credentials, escalate privilege beyond declared scope, or use credentials outside the systems you declared.
credentials
authenticated testing means Anthropic sees your credentials.
test credentials you supply may pass through Anthropic, our AI provider, during the scan. this is not optional - it is how authenticated testing works. a test login can also be a pasted session: cookies, a browser storage export, or an access token with an optional refresh token. a pasted session is a test credential and is treated like a password. it leaves recon.sh, a third party AI provider sees it while the scan runs, we delete our copy when the scan starts (or within 24 hours if the scan never starts), and you must revoke the session after your report arrives. use only a test account. do not use or sign out of the test account until the report arrives. we use your credentials only for the scan you started them on. we remove our stored copy the moment the scan starts (or within 24 hours if the scan never starts, or when it is cancelled) and log a deletion event in the audit log; the scanner deletes its own working copy when the scan finishes. a scan that has not started within 24 hours of being queued is cancelled and its credits come back, because it cannot run logged in without them. stored test credentials are never included in our backups. what we do not promise: we cannot make representations about Anthropic's data handling or training practices beyond what it itself publishes. if that matters to your organization, do not use authenticated testing until we publish a signed data processing agreement with Anthropic covering training opt-out. we will update this section when that changes. treat any credentials you give us as compromised the moment the scan finishes. the report will remind you to rotate them. your findings are yours. we do not sell them, share them, or use them to train models we operate.
accounts
your account, your reports, your share links.
you need an account to start a scan. you log in with a one-time link we email to you; there is no password. whoever controls your inbox can log in as you, so keep it secure. you are responsible for activity under your account. a report opens only for the account that started the scan. you can create one read-only share link per finished report. anyone with the link can read and download the report as it stands, including unlocked findings and their evidence, without logging in. you are responsible for who you give a share link to and for what they do with the report. you can revoke a link at any time, and it stops working on the next request. revoking a link does not recall a copy that was already downloaded. creating a new link replaces the old one. if the report contains personal data of your users, sharing the link is your decision as the controller of that data, and you are responsible for it.
credits
prepaid credits, $1 each.
recon.sh runs on prepaid credits. one credit is worth $1 of the service. you buy credits in packs (see pricing) and spend them on scans and on unlocking findings. we spend your oldest credits first, and we never spend from a pack you have cancelled or one with a refund requested or completed. credits are a prepaid balance for recon.sh only. they are not money, cannot be transferred, sold, or moved to another account, and cannot be exchanged for cash except as these terms say: the 14-day pack cancellation, and the account closure rule, both in "payment and refunds". credits never expire. unused credits stay on your account until you spend them. credits we give back are credits like any other and can be spent on anything. credits given back for a scan that failed or timed out return to the pack they came from, so they still count as unspent if you cancel that pack within 14 days. credits given back for a finding that did not reproduce are not refundable in cash, except as the law requires.
pricing
what a scan and an unlock cost.
prices and packs:
scan - 5 credits ($5), charged when you start the scan. the severity summary is included. critical - 499 credits ($499) per finding unlocked high - 199 credits ($199) per finding unlocked medium - 99 credits ($99) per finding unlocked low - 49 credits ($49) per finding unlocked informational - free to read bundle (offered only when 2+ paid findings unlock together) - your highest-priced finding at its full price, then 30% off every other finding in the bundle credit packs: $25 - 25 credits $100 - 100 credits $250 - 275 credits (+10% bonus) $500 - 575 credits (+15% bonus) $1000 - 1200 credits (+20% bonus)
the scan charge is taken from your credits when you start the scan; if you do not have enough credits, the scan does not start. the severity summary comes with every scan. unlocking findings is optional, and you choose which ones to unlock. there are no subscriptions. the scan starts the moment you ask for it. by starting it you ask us to begin at once, and you accept that a completed scan cannot be cancelled. if you are a consumer, that is why your right to cancel does not cover a completed scan.
payment and refunds
packs through Polar. credits back if a finding doesn't reproduce.
credit packs are sold by Polar, our Merchant of Record, who also handles sales tax/VAT. pack prices include VAT/GST where the law requires it. in the US, Canada and India, sales tax is added at checkout where it applies. by buying a pack you also agree to Polar's buyer terms (polar.sh/legal/checkout-buyer-terms). a scan that ends failed or timed out always gets its scan charge back as credits, to the pack it came from. this happens automatically; in the rare case the automatic step fails, a person completes it, and you never need to ask. a scan that completes is not refunded, whatever it finds. a finding is digital content, delivered the moment you unlock it. before each unlock you confirm that you want the findings delivered right away and that you lose any right to cancel or withdraw from that unlock once they are delivered; if you do not confirm, the unlock does not happen. we email you a record of each unlock and of that confirmation. once a finding is unlocked, the credits it cost are spent and do not come back, except under the reproduction guarantee below and any right the law gives you. every paid finding ships with: the full HTTP request that triggered the bug (method, URL, all headers, body); the HTTP response or a relevant excerpt proving the vulnerability; numbered reproduction steps you can run yourself; a copy-paste PoC script where applicable; and a screenshot for browser-rendered or visual bugs where applicable. this is the evidence package. a finding does not reproduce when you follow the exact reproduction steps in that evidence package - using the identical inputs, headers, and request sequence documented - against the same host and path that was tested, and the described vulnerability is not observable at that endpoint. the target environment must be materially unchanged from scan time: no patches, config changes, dependency updates, firewall rule modifications, or code deployments between scan completion and the reproduction attempt. a valid claim is about the finding being wrong at the time of the scan, not about a vulnerability you have since corrected. our reproduction guarantee. this guarantee is something we add on top of the rights the law gives you; it never takes any of them away. if a finding does not reproduce, you can claim its credits back under this guarantee within 7 days of unlocking it. to file a claim, email team@recon.sh with the finding ID and scan ID, a screen recording or equivalent documented evidence of your failed reproduction attempt, the exact steps you followed, and the production URL you tested against - staging environments don't qualify. claims are processed within 5 business days. as part of that review, we may re-run the finding's exact reproduction steps against your live target - if the vulnerability reproduces from our side, the claim is denied. if we confirm the finding is non-reproducible against the original target, the credits that finding cost come back to your account and the finding locks again: you lose access to its evidence package on our site, and any export you downloaded is yours to keep. this does not apply if you also bought that finding through our earlier per-finding checkout. if we determine the finding does reproduce, or that the environment changed, or that your evidence shows partial reproduction, we'll explain our reasoning. that is our decision under this guarantee, and we do not re-open it. a claim without a documented reproduction attempt is not a guarantee claim. under this guarantee, no credits come back if the vulnerability was patched or mitigated after the scan completed; you tested against a staging server, a different subdomain, or any host not named in the evidence; you modified the payload, skipped steps, or used different tooling than documented; or the claim was filed more than 7 days after unlock. for findings unlocked together as a bundle, a confirmed non-reproducing finding gives back its share of the bundle price. each finding's share is rounded to a whole credit: the priciest finding carries its full price plus any rounding difference, each other finding carries its price less the 30% bundle discount. the shares always add up to what you paid for the bundle. under this guarantee, credits back is the remedy for a finding paid for with credits that does not reproduce. if you are a business customer, it is the only remedy. if you are a consumer, nothing in this guarantee limits your legal rights when digital content is not as described, including the time the law gives you to complain, the remedies the law gives you, and who has to prove what; where those rights give you more than this guarantee, you have them too. cancelling a pack (your 14-day right). you can cancel a pack purchase within 14 days of buying it, for any reason. because you asked us to make the credits usable right away, cancelling gives you back the price of the credits in that pack that you have not spent: the pack price times the share of that pack's credits still unspent, plus any tax charged on that part. credits taken for a scan that failed or timed out count as unspent. the refund goes back through Polar to the payment method you used, within 14 days of your cancellation. after the 14 days there is no cash refund, except on account closure (below), and the credits stay on your account. to cancel, use the cancel control on your account page, or email team@recon.sh. a message like this is enough: "i cancel my purchase of the [pack] credit pack, order [order id], bought on [date]." the day you send it counts, not the day we process it. once you cancel, the pack's credits can no longer be spent. this is your legal right as a consumer where the law gives you one, and we give it to every customer. account closure. if you close your account, or we close it for a reason other than a breach of these terms, we refund your unused paid credits in cash: each pack's unspent credits at that pack's own rate, plus any tax charged on that part, through Polar to the original payment method. credits we gave back are not paid out, except as the law requires. if we suspend or close your account because you broke these terms (for example testing a target you were not authorized to test), unused credits are frozen while we investigate and refunded at the same rate unless the law lets us keep them to cover the loss or liability your breach caused us. findings bought with money through our earlier per-finding checkout, before credits, keep the terms they were bought under. if one does not reproduce under the rules above, claimed within 7 days of unlock, you are refunded in cash the share of the price attributed to that finding (for a bundle, the priciest finding at its full price, each other finding at the 30% bundle discount), plus any sales tax charged on it. if you bought a finding before accounts existed and cannot open it, email team@recon.sh with your order id and we will link that report to your account. the next paragraph also applies only to those purchases. a finding is digital content delivered the moment your payment is confirmed. at checkout you confirm that you want it delivered immediately and that you lose any right to cancel or withdraw from the purchase once it is delivered; if you do not confirm, you cannot complete the purchase. we email you a confirmation of the purchase that records this. a finding that was paid for but never delivered can always be cancelled for a full refund, and the reproduction guarantee above still applies.
retests
checking a fix.
after you fix a finding you unlocked, you can retest it. a retest costs 5 credits per finding, taken when the retest starts. we replay the finding's proof of concept against your live target and record one result per finding: still vulnerable, not reproduced, or inconclusive. "not reproduced" means our proof of concept no longer worked against your target on the date shown. it is not a statement that the vulnerability is gone. a firewall or a change elsewhere can also stop it. findings with an inconclusive result get their credits back, to the pack they came from. a retest that does not finish gives back every finding's credits. a retest needs a fresh authorization, the DNS check and, for findings that needed a login, fresh test credentials, like a scan. the same rules on non-destructive testing apply. a retest does not extend how long the report is kept.
audit log
some records can't be deleted.
we maintain an append-only audit log of domain verification events (method, token, evidence, outcome, timestamp, IP address, user agent), warranty and terms acceptances, each linked to its scan (your request to start the scan, the version and exact wording of the statements shown and a hash of each, the terms version, timestamp, IP address, user agent, time zone, dwell time), credential deletion events, unlock confirmations (the version and exact wording you confirmed, the findings, credits and spend they cover, timestamp, IP address, user agent, time zone, dwell time, and the id of the confirmation email we sent), and report expiry events. these records cannot be deleted on request. they are kept for as long as your account exists and for 7 years after it closes, the period in which a claim about authorization could still be brought. the database enforces append-only at the storage layer: no application-level update or delete path exists. we keep these records on the legal bases described in the privacy policy; using the service does not make them optional.
acceptable use
don't use us to test what you don't own.
you may not test infrastructure you do not legally control. you may not use findings to threaten or extort any person or organization. you may not resell scans or findings as your own security service. violations may result in immediate suspension and may be reported to relevant authorities.
sanctions and export
sanctions and export limits.
you may not use recon.sh if you are located in, ordinarily resident in, or acting on behalf of any party in a country or region subject to comprehensive economic sanctions, or if you are on a sanctions or denied-party list maintained by the united states, the EU, the UK, or the united nations. you agree to comply with all applicable export-control and sanctions laws, and you will not use the service to test infrastructure owned or controlled by a sanctioned party. if we learn you are a sanctioned or denied party, we will suspend your access.
disclaimers
the scan has limits. a clean report is not a certification.
THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. we do not warrant that the scan will discover all vulnerabilities - external testing has inherent limits. we do not warrant that the service will be uninterrupted or error-free. a clean report is not a compliance certification and should not be represented as one. attestation letters. you can issue an attestation letter at no charge for a finished scan. it states that the test took place, its scope and dates, and the results at the time; it is not a certification and does not state that your systems are secure, and the same rule as for reports applies: do not represent it as one. you are responsible for the company name you put on it and for how you present it. you can revoke a letter at any time; we may revoke a letter that is used to misrepresent the test or your security. a letter stays viewable at its link until it is revoked, and a revoked letter shows that it was revoked. our total liability to you for all claims arising out of or related to the service, in contract, tort, or otherwise, is capped at the greater of $100 or the amounts you paid for the service (through our merchant of record) in the 12 months before the claim. to the maximum extent permitted by applicable law, we are not liable for indirect, incidental, special, or consequential damages, including loss of revenue, loss of data, or business interruption. nothing in these terms excludes or limits liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or any liability that applicable law does not allow to be excluded or limited. if you are a consumer, the cap and the exclusion above apply only to the extent the law of the country where you live permits, and never below the amount you paid for the finding or scan the claim is about. if you are a consumer, you have legal rights when digital content is not as described, and nothing in this section takes them away.
indemnification
you own what you do with the scan.
you are solely responsible for the target you declare, the scope you select, and your authority to test them. you decide what recon.sh is pointed at, and you assume the risk of testing systems you control, including any damage the scan causes to them. you confirm you are aware that a security scan can cause damage and that you accept that risk. you will indemnify, defend, and hold harmless PurpleOps Ltd, its affiliates, and their officers, directors, employees, and contractors from and against any claim, loss, liability, or expense (including reasonable attorneys fees and the cost of defense), whether brought by you or by a third party, arising out of or relating to: your testing of infrastructure you did not have legal authority to test; your breach of the pre-scan warranty; your breach of any other provision of these terms; your choice of target or scope; or your misuse of a finding or report. this includes claims brought by a hosting provider, cdn, or other service operator whose infrastructure was reached through a hostname you declared or a subdomain discovered under it. we may control the defense of any claim you indemnify, and you will cooperate with it. if you are a consumer, this indemnity covers only claims by third parties that arise from your breach of the pre-scan warranty or from testing infrastructure you had no authority to test, and only to the extent the law of the country where you live allows. this indemnification survives termination of your account.
suspension
when we can close your account.
we may suspend or terminate your access if you breach these terms, if we believe your use poses legal risk to third parties, or if required by law or court order. suspension does not entitle you to a refund of a scan already run or a finding already unlocked. what happens to unused credits is set out under "account closure" in payment and refunds. you can close your account at any time from your account page, or by emailing team@recon.sh. what happens to unused credits is set out under "account closure" in payment and refunds. closing does not delete the records described in "audit log".
governing law
israeli law, tel aviv courts.
these terms are governed by the laws of the state of israel, without regard to conflict-of-law rules. the competent courts of tel aviv-jaffa have exclusive jurisdiction over any dispute arising out of or relating to these terms or the service. if you are a consumer under the mandatory law of the country where you live, nothing in this section takes away protections or court access that law gives you. either party may seek emergency injunctive relief in any court of competent jurisdiction to prevent irreparable harm. claims within the jurisdiction of a small claims court may be brought there.
general
the legal plumbing.
if any part of these terms is held unenforceable, the rest stays in effect. these terms, together with the privacy policy and any warranty you accept, are the entire agreement between you and recon.sh about the service, and replace any prior understanding. you may not assign these terms without our consent; we may assign them to a successor, for example on incorporation or acquisition. neither party is liable for failure to perform caused by events beyond its reasonable control. we give you notices by email or by posting on the site; you give us notice at team@recon.sh. our failure to enforce a provision is not a waiver of it.
changes
when these terms change.
when we update these terms, we change the version and effective date on this page and, for material changes, email your account address at least 30 days before they take effect. which version applies: a credit pack, and the credits that came from it, keep the terms in force when you bought the pack, including the price, the credits it gave, the 14-day cancellation and the no-expiry rule. a scan keeps the terms in force when you started it. the rules for your account, share links, acceptable use, suspension and closure are the current version. if a change to the account rules is to your disadvantage and you do not accept it, you can close your account before it takes effect and we refund your unused paid credits as described under "account closure". starting a scan or buying a pack after the effective date means you accept the version then in force.
contact
legal questions.
legal notices: team@recon.sh. postal address for legal notices: PurpleOps Ltd, Sokolov 68, Herzliya, israel. service questions and refund requests: team@recon.sh. security issues about recon.sh itself: team@recon.sh.