Terms of Service

Acceptance of Terms

By accessing or using SafePush ("the Service", "we", "us"), you agree to be bound by these Terms of Service. If you do not agree, do not use the Service.

These terms apply to all users — guest users, free account holders, and paid subscribers.

What SafePush Does

SafePush analyses infrastructure-as-code files (Terraform, Dockerfile, Kubernetes YAML, Helm Charts, GitLab CI, and Jenkinsfile) and returns security findings, misconfigurations, and suggested fixes using static rules and AI analysis.

Important limitations you must understand:

• SafePush is a code review aid, not a certified security audit tool.
• Our analysis may not catch every issue. Results should be reviewed by a qualified engineer before acting on them.
• AI-generated fix suggestions may contain errors. Always test fixes in a non-production environment first.
• SafePush does not access your live infrastructure, cloud accounts, or runtime systems. We only analyse the code you paste.

Accounts & Registration

SafePush uses Google OAuth for authentication. By signing in, you authorise us to receive your Google account email address and profile picture. We do not receive your Google password.

• You must be 18 years or older to create an account.
• You are responsible for all activity that occurs under your account.
• You must not share your account with others or use another person's account.
• We reserve the right to suspend or terminate accounts that violate these terms.

Plans, Payments & Billing

SafePush offers the following plans:

• Free: 30 scans/month at no cost. No credit card required.
• Starter ($9/month): 500 scans/month, all file types, AI fixes, scan history.
• Pro ($25/month): 1,500 scans/month, AI fixes, shareable reports, full history.
• Team ($59/month): Unlimited scans, 5 team members, priority support.

Payments are processed by LemonSqueezy, our payment processor. By purchasing a paid plan, you also agree to LemonSqueezy's terms of service. We do not store your payment card details.

Subscriptions renew automatically each month on your billing date. You can cancel at any time from your LemonSqueezy billing portal. Cancellation takes effect at the end of your current billing period — you retain access until then.

Scan counts reset on the 1st of each calendar month. Unused scans do not roll over.

We reserve the right to change plan pricing with 30 days notice to existing subscribers.

Refund Policy

Due to the digital nature of the service and immediate access provided upon payment, we generally do not offer refunds. However:

• If you were charged in error (duplicate charge, technical failure), contact us within 7 days and we will refund in full.
• If you are genuinely unsatisfied with your first month of a paid plan and have used fewer than 10 scans, contact us within 14 days of your first payment and we will review your request.

To request a refund, email vulnerscope24@gmail.com with your account email and reason.

Your Data & Privacy

What we collect:

• Your email address and Google profile picture (from Google OAuth)
• The infrastructure code you submit for scanning (first 500 characters stored for scan history)
• Scan results and security findings
• Usage data (scan count, plan type, timestamps)

What we do not collect:

• Your Google password or full Google account data
• Your payment card details (handled entirely by LemonSqueezy)
• Your live cloud infrastructure or runtime data

How we use your data:

• To provide the scan service and return results to you
• To enforce plan limits and billing
• To improve our detection rules and AI analysis (anonymised, aggregated)
• We do not sell your data to any third party
• We do not use your submitted code to train AI models without explicit consent

Data retention: Scan results are retained for your scan history per your plan. If you delete your account, your data is deleted within 30 days. Contact us to request deletion at any time.

Security: Data is stored in Supabase (PostgreSQL) with encryption at rest. Connections use TLS. Authentication tokens are httpOnly cookies with 7-day expiry.

SafePush is operated from India. By using the service, you consent to your data being processed in accordance with applicable Indian data protection laws.

Acceptable Use

You agree not to use SafePush to:

• Submit code containing malware, exploits, or content designed to harm systems
• Attempt to extract, reverse-engineer, or scrape our AI prompts or detection rules
• Circumvent scan limits through multiple accounts or automated abuse
• Submit another person's proprietary code without authorisation
• Use the service for any illegal purpose under applicable law
• Attempt prompt injection attacks or deliberate manipulation of our AI pipeline

Violation of acceptable use may result in immediate account suspension without refund.

Intellectual Property

Our IP: SafePush, its detection rules, AI prompts, interface, and branding are owned by the SafePush team. You may not copy, reproduce, or create derivative works without written permission.

Your IP: You retain full ownership of the code you submit. By submitting code, you grant us a limited, non-exclusive licence to process it for the purpose of returning scan results to you. We do not claim ownership of your code.

Scan results: The security findings and fix suggestions we return to you are yours to use freely — in your reports, with your clients, in your codebase.

Disclaimer of Warranties

SafePush is provided "as is" without warranty of any kind. We do not warrant that:

• The service will be uninterrupted, error-free, or available at all times
• Our analysis will catch every security issue in your code
• AI-generated fix suggestions are correct, complete, or production-ready
• The service meets your specific compliance or regulatory requirements

SafePush scan results are not a substitute for a professional security audit. Do not rely solely on SafePush for production security decisions.

Limitation of Liability

To the maximum extent permitted by applicable law, SafePush and its operators shall not be liable for:

• Any indirect, incidental, or consequential damages arising from use of the service
• Security breaches, data loss, or infrastructure failures in your systems — even if SafePush failed to detect the issue that caused them
• Loss of revenue or business resulting from reliance on our scan results
• Downtime, service interruptions, or data loss on our platform

Our total liability to you for any claim arising from use of the service shall not exceed the amount you paid us in the 3 months preceding the claim.

Termination

You may stop using SafePush and delete your account at any time by contacting us at vulnerscope24@gmail.com.

We may suspend or terminate your account if you violate these terms, abuse the service, or if we reasonably believe your use poses a risk to other users or the platform. In such cases, no refund will be issued.

Upon termination, your scan history and account data will be deleted within 30 days.

Changes to These Terms

We may update these terms as the service evolves. When we make material changes, we will update the "Last updated" date at the top of this page.

For significant changes affecting paid subscribers (pricing, data handling, service scope), we will notify you by email at least 14 days in advance.

Continued use of SafePush after changes constitutes acceptance of the updated terms.

Contact

These terms are governed by the laws of India. For any legal notices, disputes, or questions about these terms, contact us at: