Acceptable use
Last updated 20 October 2026
This policy covers the paid runs, the free Sniff Score, the API, the MCP server and the CLI. It is part of our Terms.
Only test what you're allowed to test
Our agents drive a real browser against the address you give us. Only use Bugsniffer on an app you own, or one whose owner has authorised you in writing to have it tested with automated tools. That includes the free tools. Don't point Bugsniffer at someone else's app, at a customer's app without their permission, or at a system you can't prove you control.
What we refuse
The paid runs and the free Sniff Score refuse the most popular sites on the internet, big brands, banks and payment services, government and military sites, private or internal addresses, localhost and non-standard ports. They only load public https addresses on the standard ports. A paid order that hits the list is refunded automatically.
Don't
- use Bugsniffer to attack, probe, scan for vulnerabilities, overload or harm any system, or as a way to reach a system you aren't allowed to reach;
- give us a target that hosts malware, phishing, illegal content or content that sexualises children, or use the service to harass anyone;
- put instructions on a page to push our agents into doing something outside the test, such as visiting other sites or revealing their instructions;
- get around our limits, Turnstile checks or blocked list, including with extra keys, accounts, devices or addresses;
- resell, sublicense or offer the free API to others as a service, or share your API key;
- use a real person's account, real payment details or production admin access as a test account;
- try to reach other customers' reports, our systems or our providers' systems, or reverse-engineer our service to avoid paying for it.
Limits
The free Sniff Score allows 5 scores a day from one network, with a short burst limit and a daily cap across all users. A free API key allows 10 new scores a day (UTC) and at most 4 requests a minute, and one network can create 3 keys a day. Paid runs are queued and run one at a time. We may change these limits, and we may stop any use that looks abusive.
How our agents behave
Our agents are told, and technically restricted, to stay on the address you gave us. They act at human speed, make no more than three tries at any login, code or form, don't try to get around captchas or firewalls, don't read your source code or guess hidden addresses, don't email third parties, and don't make real payments. They are AI, so we can't promise perfection. If you see something that looks wrong, email us straight away.
If we tested your site and you didn't ask us to
Email [email protected] with the domain. We'll stop any run, delete any result and report for it, and block the domain from our tools. We aim to act within 2 business days. You don't need to prove anything beyond showing you control the domain, such as replying from an address on it.
Finding a security problem in Bugsniffer
Tell us at [email protected]. Give us a reasonable time to fix it before you share it, and please don't access other people's data, disrupt the service or test beyond what you need to show the problem. We won't take action against good-faith research that follows these rules.
What happens if you break this policy
We may warn you, rate-limit you, revoke API keys, refuse or stop orders, block domains or accounts, and end your access, as the Terms allow. Where the law requires or allows it, we may report unlawful activity to the authorities and tell the owner of an affected app.
Operated by Nion Enterprises, ABN 74 510 442 749. Payments by Stripe.
Questions: [email protected]