Terms & Conditions

1. Acceptance of Terms

By accessing or using the shadowaudit dashboard service (the "Service"), operated by Ubaid ur Rehman, an individual doing business as shadowaudit ("Provider," "we," "us", or "our"), you agree to be bound by these Terms and Conditions (the "Terms"). If you do not agree to these Terms, you must not access or use the Service. These Terms constitute a legally binding agreement between you ("you", "your", or "Customer") and the Provider. If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms, and the terms "you" and "your" refer to that organization.

We may modify these Terms at any time. We will post the updated Terms and update the "Last updated" date. Your continued use of the Service after changes become effective constitutes your acceptance of the modified Terms. If you do not agree to the modified Terms, you must stop using the Service. Changes do not apply retroactively.

2. Description of Service

shadowaudit is an API security scanning tool that detects undocumented ("shadow") API endpoints, missing authentication, and other API surface-area risks. The Service includes a web dashboard that displays scan results, generates API Bill of Materials (ABOM) reports, and provides badge URLs for documentation. The Service is provided in two tiers: a free tier (CLI-only) and a paid Pro tier (dashboard access with additional features). We may modify, suspend, or discontinue the Service, in whole or in part, at any time without notice, and we will not be liable to you or any third party for such modification, suspension, or discontinuance.

3. Subscriptions, Billing & Refunds

The Pro tier is billed at $19 per month via Gumroad (our Merchant of Record). All fees are payable in advance and are non-refundable except as expressly stated in this Section. Subscriptions renew automatically until canceled. You may cancel at any time through Gumroad or by contacting support; cancellation takes effect at the end of the current billing period and you retain access until then.

Refund Policy: All subscription fees are non-refundable. By subscribing, you acknowledge and agree that: (a) you are purchasing access to a digital service that begins immediately upon payment; (b) due to the immediate and digital nature of the Service, no refunds are available for any billing period, including partial months; (c) you may cancel at any time to prevent future charges, but no refunds will be issued for charges already incurred; (d) accounts terminated for violation of these Terms forfeit all fees paid; (e) accounts inactive for more than 90 days are not eligible for any refund or credit.

EU/UK Consumer Rights: If you are a consumer in the European Union or United Kingdom, you may have a statutory 14-day withdrawal right under Directive (EU) 2011/83 or the UK Consumer Contracts Regulations 2013. However, by checking the box at checkout acknowledging immediate delivery of digital content, you expressly consent to early performance and waive your withdrawal right for the service already provided, pursuant to Article 16(m) of Directive (EU) 2011/83. This waiver does not affect your statutory rights regarding non-conforming goods or services.

Chargebacks: If you initiate a chargeback through your card issuer without first contacting us at ubaid0345@proton.me, we may dispute the chargeback. Accounts with disputed chargebacks may be suspended pending resolution.

You authorize us and Gumroad to charge your payment method for all fees incurred under your account. You are responsible for maintaining accurate payment information. If a payment fails, we may suspend access until payment is resolved.

4. Acceptable Use & Prohibited Conduct

You agree NOT to:

• Use the Service to scan applications you do not own or have explicit written authorization to test
• Use the Service for any illegal, harmful, fraudulent, infringing, or malicious purpose
• Attempt to reverse engineer, decompile, disassemble, or otherwise extract the Provider's proprietary scanning logic, algorithms, or source code
• Share, resell, sublicense, rent, lease, or transfer your account, token, or subscription to another party
• Maintain multiple accounts or use the Service to exceed usage limits intentionally
• Abuse, overload, or interfere with the Service's infrastructure, including rate-limit evasion, DDoS attacks, or automated scraping
• Use automated tools (bots, crawlers, scrapers) to access the dashboard or APIs without prior written permission
• Bypass or attempt to bypass any security measure, access control, or usage limit
• Submit content that contains malware, viruses, or harmful code
• Remove, alter, or obscure any copyright, trademark, or attribution notices
• Use the Service to develop, train, or improve a competing product
• Upload source code or data that you do not have the right to upload

Violation of this Section may result in immediate account termination, subscription cancellation without refund, and permanent ban from the Service. We reserve the right to investigate suspected violations and report illegal activity to law enforcement.

5. Account Security & Token Responsibility

You are solely responsible for safeguarding your unique access token. Treat your token as you would a password — do not commit it to public repositories, share it in screenshots, transmit it over unsecured channels, or disclose it to third parties. You are responsible for all activity that occurs under your token, whether authorized or unauthorized. The Provider is not liable for any loss, damage, or unauthorized access arising from your failure to protect your token.

If you believe your token has been compromised, contact support immediately to rotate it. We reserve the right to suspend or revoke any token that we believe has been compromised or is being used in violation of these Terms. We are not liable for any damages resulting from unauthorized access, even if we are notified of the compromise.

6. Intellectual Property Rights

The shadowaudit CLI is open-source software released under the MIT license. The web dashboard, Service infrastructure, ABOM report templates, badge designs, visual identity, documentation, and all related materials are proprietary to the Provider and protected by copyright, trademark, and other intellectual property laws. No license is granted except as expressly stated in these Terms.

You retain all rights to the scan results and source code you submit to the Service. By uploading scan data, you grant the Provider a limited, non-exclusive, royalty-free, worldwide license to process and store that data solely to provide the Service to you. We do not claim ownership of your data. We will not access, view, or use your data except as necessary to operate the Service, prevent abuse, or comply with legal obligations.

The "shadowaudit" name, logo, and brand assets are trademarks of the Provider. You may use badge URLs and ABOM reports generated by the Service in your own documentation, provided you do not alter them or remove attribution. You may not use our trademarks to imply endorsement, partnership, or affiliation without written permission.

7. Data Retention & Deletion

Scan data is retained for the lifetime of your active account. If you cancel your subscription, your data is retained for 90 days in case you resubscribe, after which it is permanently and irreversibly deleted. You may request immediate deletion at any time by contacting support; deletion requests are processed within 30 days. Token records (without scan data) are retained indefinitely for billing reconciliation, fraud prevention, and legal compliance.

We are not responsible for data loss caused by: (a) account termination for Terms violations, (b) expiration of the 90-day retention window, (c) database failures or corruption, or (d) your failure to maintain a backup of your scan data. You are encouraged to export and back up your data regularly.

8. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. WE EXPRESSLY DISCLAIM ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR THAT DEFECTS WILL BE CORRECTED.

WE DO NOT GUARANTEE THAT THE SERVICE WILL IDENTIFY ALL SECURITY VULNERABILITIES OR THAT SCAN RESULTS ARE COMPLETE, ACCURATE, OR UP-TO-DATE. THE SERVICE IS A SUPPLEMENT TO, NOT A REPLACEMENT FOR, A PROFESSIONAL PENETRATION TEST, FORMAL SECURITY AUDIT, OR COMPLIANCE ASSESSMENT. USE OF THE SERVICE DOES NOT CREATE ANY WARRANTY, REPRESENTATION, OR GUARANTEE THAT YOUR APPLICATION IS SECURE, COMPLIANT, OR FREE FROM VULNERABILITIES. YOU ACKNOWLEDGE THAT SECURITY SCANNING IS AN INHERENTLY IMPERFECT PROCESS AND THAT FALSE POSITIVES AND FALSE NEGATIVES MAY OCCUR.

ADVICE OR INFORMATION OBTAINED FROM THE SERVICE IS NOT ADVICE AND DOES NOT CREATE ANY WARRANTY. YOU USE THE SERVICE AND RELY ON ITS OUTPUT AT YOUR SOLE RISK.

9. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE PROVIDER, ITS AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR ANY DAMAGES FOR LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, WHETHER BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER THEORY, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

AGGREGATE LIABILITY CAP: The Provider's total aggregate liability for any and all claims arising out of or related to these Terms or the Service, whether in contract, tort, or any other theory, shall not exceed the amount you paid to the Provider in the twelve (12) months preceding the event giving rise to the claim, or $19 USD, whichever is greater.

THE LIMITATIONS IN THIS SECTION APPLY EVEN IF ANY REMEDY FAILS OF ITS ESSENTIAL PURPOSE. THESE LIMITATIONS ARE A MATERIAL BASIS OF THE BARGAIN BETWEEN YOU AND THE PROVIDER.

10. Indemnification

You agree to defend, indemnify, and hold harmless the Provider, its affiliates, officers, directors, employees, and agents from and against any and all claims, lawsuits, demands, damages, liabilities, losses, costs, and expenses (including reasonable attorneys' fees and court costs) arising out of or related to: (a) your use or misuse of the Service; (b) your violation of these Terms; (c) your violation of any law or third-party rights, including intellectual property rights; (d) any data or content you submit to the Service; or (e) any claim that your use of the Service caused damage to a third party.

We reserve the right, at our own expense, to assume the exclusive defense and control of any matter subject to indemnification by you (without limiting your indemnification obligations). You will not settle any matter without our prior written consent. This indemnification obligation survives termination of your account or these Terms.

11. Binding Arbitration & Class Action Waiver

Arbitration: Except for disputes that qualify for small claims court, any dispute, claim, or controversy arising out of or relating to these Terms or the Service shall be resolved by final and binding arbitration administered by the American Arbitration Association ("AAA") under its Consumer Arbitration Rules then in effect, except as modified by this Section. The arbitration shall be conducted before a single arbitrator. The place of arbitration shall be the county where you reside. Judgment on the award may be entered in any court having jurisdiction.

Class Action Waiver: YOU AND THE PROVIDER AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. UNLESS BOTH YOU AND THE PROVIDER AGREE OTHERWISE, THE ARBITRATOR MAY NOT CONSOLIDATE MORE THAN ONE PERSON'S CLAIMS, AND MAY NOT OTHERWISE PRESIDE OVER ANY FORM OF A REPRESENTATIVE OR CLASS PROCEEDING. IF THIS CLASS ACTION WAIVER IS FOUND TO BE UNENFORCEABLE, THEN THE ENTIRE ARBITRATION AGREEMENT IS VOID, AND THE DISPUTE SHALL BE RESOLVED IN COURT.

Opt-Out: You may opt out of this arbitration agreement by sending written notice to ubaid0345@proton.me within 30 days of first accepting these Terms. The notice must include your name, token, and a clear statement that you opt out of arbitration.

Pre-Arbitration Notice: Before initiating arbitration, you must first contact us at the email above with a detailed description of your claim and allow us 60 days to resolve the dispute. If we cannot resolve it, you may then initiate arbitration.

12. Attorney Fees

In any dispute arising out of or related to these Terms, the prevailing party shall be entitled to recover its reasonable attorneys' fees and costs from the non-prevailing party, except where prohibited by law or where the dispute was resolved through arbitration under Section 11 and the arbitrator rules otherwise.

13. Termination

We may suspend or terminate your access to the Service at any time, with or without cause or notice, including for violation of these Terms. Upon termination, your right to use the Service ceases immediately, and all of your data will be deleted within 30 days, except where retention is required by law or these Terms. Sections that by their nature should survive termination — including Intellectual Property, Disclaimer, Limitation of Liability, Indemnification, Arbitration, and Attorney Fees — shall remain in full force and effect.

You may terminate your account at any time by contacting support. Termination does not entitle you to a refund of fees already paid, except as expressly stated in Section 3.

14. Force Majeure

We are not liable for any delay or failure to perform our obligations under these Terms where the delay or failure is caused by events beyond our reasonable control, including but not limited to: natural disasters, pandemics, war, terrorism, civil unrest, government actions, labor disputes, power outages, internet or telecommunications failures, third-party service outages (including Gumroad, Vercel, Neon, and cloud providers), cyberattacks, or acts of God. We will use reasonable efforts to resume performance as soon as commercially practicable.

15. Governing Law & Venue

These Terms are governed by the laws of the Islamic Republic of Pakistan, without regard to its conflict of law provisions. For disputes not subject to arbitration under Section 11, the parties submit to the exclusive jurisdiction of the courts of Karachi, Pakistan. Notwithstanding the foregoing, if you are a consumer residing in the European Union, the United Kingdom, or any jurisdiction with mandatory consumer-protection laws, nothing in these Terms deprives you of the protections afforded to you by the mandatory provisions of the law of your country of residence.

16. No Waiver; Severability

Our failure to enforce any right or provision of these Terms is not a waiver of that right or provision. If any provision of these Terms is found by a court or arbitrator to be unenforceable, the parties nevertheless agree that the court or arbitrator should endeavor to give effect to the parties' intentions as reflected in the provision, and the other provisions of these Terms remain in full force and effect.

17. Entire Agreement

These Terms, together with our Privacy Policy and any other policies incorporated by reference, constitute the entire and exclusive understanding and agreement between you and the Provider regarding the Service, and supersede all prior agreements, whether oral or written. No oral statement by any representative of the Provider will modify these Terms.

18. Contact

For questions about these Terms, contact ubaid0345@proton.me.