Terms of use

HexBrain exists to help people find and fix security bugs. By using the site, its downloads or its API you agree to the following.

Test only what you are allowed to test

Everything here is for authorised security testing, research and learning. Use payloads, CVE checks and techniques only on systems you own or have permission to test, such as assets inside the published scope of a bug bounty programme.

The subdomains listed for a programme are names known to exist, not a statement of scope. Many are out of scope. Read the programme's own policy before you touch any of them.

Whose content this is

Reports belong to their authors and to the programmes that disclosed them; we link each one to its original. Payload references, CVE checks and subdomain data come from the open projects credited on the About page, under their own licences. HexBrain is independent and is not affiliated with HackerOne or any programme shown.

Accounts and the API

• API keys are given by invitation and are personal to you. Keep them private; you are responsible for what is done with them.
• Each account has request limits. Do not try to get round them, for example with extra accounts.
• We may withdraw access from anyone who misuses the service, and we may change or stop the API.

No warranty

The data is gathered automatically from public sources and will contain mistakes and gaps. It is provided as it is, without any guarantee that it is accurate, complete or current. Reports are sorted into classes by machine, and a CVE check marked as likely may still be wrong. Confirm before you rely on anything here.

To the extent the law allows, HexBrain is not liable for loss or damage arising from use of the site, its data or its API.

Changes

These terms may change as the service grows. The current version is always on this page.

How personal data is handled is set out on the privacy page. Questions go to @hackerspider1.