Acceptable use

What the service is for

Excuto is a quality assurance tool. It finds bugs in sites that you have authority to audit. It is not a vulnerability scanner. It can report a secret key that a page exposes. This policy is part of our terms of service, and the same defined words apply.

What you must not do

You must not do any of these things:

• Audit a site that you do not own and have no written permission to audit.
• Start an active audit on a site whose ownership you did not prove with the DNS TXT record _qa-verify.<host>.
• Try to bypass the ownership check or the block on private addresses. This includes the use of DNS records or redirects to reach a private network.
• Use the service to attack a site, to overload it, to copy its content at scale, or to probe it for vulnerabilities.
• Evade a limit. Today, each organization can start 20 audits each UTC day. Opening more accounts to get more audits is an evasion.
• Share an API key with anyone outside your organization, or put it in public code.
• Send us illegal content, for example in the goal text of an audit, or target a site that exists to host illegal content.
• Resell the service, or offer audits as your own service, without a written agreement with us.

What we do

Our crawler follows these rules. The crawler page gives its name and details.

• robots.txt. In a passive audit, the crawler reads robots.txt once and obeys it for every link. If the file returns a server error or times out, the crawler treats the site as closed and visits no page.
• Active audits. The crawler does not read robots.txt, because the site owner proved ownership with a DNS record.
• Pause. The crawler visits one page at a time and waits 1 second between two page visits. It can also run up to 3 replays or model-review page loads at the same time. Each one reloads its page.
• Rate limits. If a site answers with HTTP 429, the crawler waits as the Retry-After header says, for 30 seconds at most. It tries once more and then skips the page.
• Scope. The crawler stays on one origin. It visits up to 25 pages in a passive audit and up to 40 pages in an active audit.
• Private networks. We refuse a URL that points to a private, loopback, link-local or other reserved address. We check at submission and again before the browser loads the page. We also refuse ports other than 80 and 443.
• Identity. The crawler names itself in its user agent. The crawler page explains how to recognize it.

How a site owner stops audits

1. Add a rule for our crawler to the robots.txt file of your site. The crawler page gives the user agent name.
2. Block the user agent at your server or firewall.
3. Email {{CONTACT_EMAIL}} with the host name of your site.

Step 1 stops passive audits only. An active audit needs a DNS TXT record on your domain. Only a person who can change your DNS can add it.

How to report abuse

If you think that someone uses Excuto against your site or against the law, email {{CONTACT_EMAIL}}. Give the host name, the time of the visits and any log lines that you have. We will read each report.

What happens if you breach this policy

If you breach this policy, we can suspend your account at once, stop your audits and revoke your API keys. We do not refund payments for the period of the breach.

We can report illegal acts to the authorities. The terms of service give more detail on suspension and termination.