Terms & Conditions

1. Who we are and what these terms cover

This website at qcramai.com and the Free Web Scan (together, the “Services”) are operated by Qcramai Private Limited, Miyapur, Hyderabad, Telangana, India (“Qcramai”, “we”, “us”). These Terms & Conditions, together with our Privacy Policy and Disclaimer, form a binding agreement between you and Qcramai. Paid engagements are governed by a separate signed statement of work, which prevails over these terms for that work.

2. Definitions

• Free Web Scan or Scan — the no-charge, self-service tool on this site that inspects a single web address you submit.
• Scan Target — the URL, host, domain or system you submit to the Scan.
• Report — the output of a Scan, including the redirect chain, TLS and certificate data, HTTP response headers, DNS and email-authentication posture, observed cookies, a screenshot of the Scan Target, a technology fingerprint, reputation/blocklist lookups, and the computed scores.
• Hack Score and Load Score — automated, heuristic 0–100 indicators described in section 8.
• You — the individual using the Services and, where you act for an organisation, that organisation, on whose behalf you confirm you are authorised to accept these terms.

3. Eligibility

You may use the Services only if you are at least 18 years old, have the legal capacity to enter into a contract, and are not barred from using the Services under any applicable law or sanctions regime. You must not use the Services if you are located in, or ordinarily resident in, a jurisdiction subject to comprehensive trade sanctions.

4. The Free Web Scan — what it does

When you submit a Scan Target, the Scan performs passive, light-touch reconnaissance from our infrastructure. Depending on the Scan Target, this may include:

• issuing ordinary HTTP/HTTPS requests to the submitted URL and following its redirect chain;
• rendering the page once in a headless browser to capture a screenshot, the network log, console output, cookies set by the Scan Target, and JavaScript-exposed globals;
• inspecting the TLS handshake and certificate, HTTP response and security headers, and common well-known paths such as /robots.txt, /.well-known/security.txt and /favicon.ico;
• reading public DNS records (A/AAAA, MX, TXT, NS, CAA, SOA) and email-authentication records (SPF, DMARC, DKIM, MTA-STS);
• sending an OPTIONS request to enumerate advertised HTTP methods;
• looking up the Scan Target’s hostname and IP address against public reputation and blocklist sources.

The Scan does not attempt to exploit any weakness, bypass authentication, submit credentials, perform injection or fuzzing, conduct denial-of-service or load testing, or access non-public areas of the Scan Target. It is a single point-in-time snapshot and is far narrower than a professional security assessment.

We operate a deny-list. The Scan will refuse targets that appear to be government, military, national-security, banking, or certain regulated domains, private or loopback addresses, and other categories we choose. This filtering is a courtesy control, is not exhaustive, and does not transfer responsibility for target selection to us.

5. Authorization and acceptable use

You may submit a Scan Target only if at least one of the following is true:

• you own the Scan Target; or
• you have current, express, written authorization from the owner of the Scan Target (or a person able to bind that owner) to perform security testing of the kind described in section 4; or
• the Scan Target is a system deliberately published for public security testing (for example, an in-scope host under a published bug-bounty or vulnerability-disclosure programme, and only within that programme’s stated rules).

Each time you start a Scan and confirm the authorization checkbox, you represent and warrant to us that the above is true for that Scan Target at that time, and that running the Scan will not breach any law, contract, or acceptable-use policy applicable to you or to the Scan Target.

You must not use the Services to:

• scan any system you do not own and are not authorised to test;
• scan infrastructure operated by a government, military, intelligence, law-enforcement, central-bank, financial-clearing, healthcare, utility, or critical-infrastructure body, regardless of any technical filtering;
• use the Report to plan, assist, or carry out unauthorised access, an attack, extortion, harassment, or reputational harm against any person or system;
• represent the Report or any score as Qcramai’s opinion, finding, certification, or verdict about a third party;
• run the Scan on a bulk, automated, or repeated basis, or circumvent rate limits, the authorization checkbox, request-origin checks, or the deny-list;
• resell, sublicense, or commercially exploit the Services or the Report;
• submit a URL that embeds credentials, session tokens, API keys, or personal data in its path or query string;
• interfere with, overload, probe, or reverse-engineer the Services themselves, or use them to transmit malware.

Certain acts described above may be criminal offences — for example under the U.S. Computer Fraud and Abuse Act, the UK Computer Misuse Act 1990, the Indian Information Technology Act 2000 (including sections 43 and 66), and equivalent laws elsewhere. Determining what is lawful for a given Scan Target is your responsibility.

6. You are the operator of the scan

The Services are a tool that acts solely on your instruction. When a Scan runs, you are the party initiating and directing activity against the Scan Target; Qcramai provides the automation and infrastructure at your request. As between you and Qcramai, you are solely responsible for the selection of the Scan Target, for having the authorization described in section 5, and for all consequences of the Scan. Qcramai does not independently verify ownership of, or authorization for, any Scan Target and gives no assurance to the operator of any Scan Target.

7. Not a penetration test or professional advice

The Free Web Scan is automated triage. It is not a penetration test, a vulnerability assessment, a security audit, a compliance assessment, or professional, legal, or regulatory advice, and it does not create any consultant, advisor, or client relationship. The Report may contain errors, false positives, false negatives, and omissions. Do not rely on it as the basis for any security, legal, financial, commercial, or compliance decision. For an assurance-grade result, engage us for a scoped penetration test.

8. Hack score and load score

The hack score is a configurable heuristic that adds weighted points for observable signals (for example missing security headers, an expired certificate, mixed content, or a blocklist hit) and maps the total to a band. The load score is derived from the Scan’s own timing measurements. Neither score is a statement that a Scan Target is safe, unsafe, trustworthy, malicious, compromised, well-built, or badly-built. A low score does not mean a site is secure; a high score does not mean a site is vulnerable or malicious. The scores are not a rating, ranking, or certification of any person or business, and must not be published or presented as such.

9. Availability, rate limits and changes

The Free Web Scan is offered without charge, “as available”, with no service level, uptime, or support commitment. We apply rate limits (currently a small number of scans per IP address per rolling window) and may change them at any time. We may modify, suspend, throttle, or discontinue any part of the Services, block any user or network, and refuse or delete any Scan or Report, at our discretion and without notice or liability.

10. Intellectual property

The Services, and all text, design, code, and branding on this site, are owned by Qcramai or its licensors and are protected by intellectual-property laws. We grant you a limited, revocable, non-exclusive, non-transferable licence to use the Services and to use a Report you generated for your own internal security purposes. All other rights are reserved. You may not use the Qcramai name, logo, or the appearance of the site or Report to imply endorsement or partnership. Content and marks belonging to a Scan Target remain the property of their owner; they appear in a Report only because you directed a Scan at that target.

11. Data and privacy

Our handling of the Scan Target you submit, your IP address, your browser metadata, and the resulting Report is described in the Privacy Policy. By using the Free Web Scan you acknowledge that we store the Report (including a screenshot of the Scan Target) and associated metadata, and that reputation checks transmit the Scan Target’s hostname and IP address to third-party lookup services.

12. Third-party data and services

Parts of a Report depend on external sources — for example public DNS resolvers, certificate data, and reputation or blocklist providers such as Spamhaus, Quad9, and abuse.ch. That data is supplied by third parties “as is”; we do not control it and are not responsible for its accuracy, availability, or the consequences of a listing or non-listing. Links from this site to third-party sites are provided for convenience and are not an endorsement.

13. Disclaimer of warranties

To the fullest extent permitted by law, the Services, the Scan, the Report, and the scores are provided “as is” and “as available”, without warranty of any kind, whether express, implied, or statutory, including any implied warranty of merchantability, fitness for a particular purpose, accuracy, completeness, quiet enjoyment, or non-infringement. We do not warrant that the Services will be uninterrupted, timely, secure, or error-free, that any Report is accurate or complete, or that use of the Services will meet any legal or regulatory requirement.

14. Limitation of liability

To the fullest extent permitted by law:

• Qcramai and its officers, employees, and contractors will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, data, goodwill, or business, arising out of or relating to the Services, the Scan, or the Report, whether in contract, tort (including negligence), or otherwise, even if advised of the possibility;
• Qcramai will not be liable for any claim brought against you by the operator of a Scan Target, for any effect a Scan has on a Scan Target, or for your failure to hold the authorization required by section 5;
• Qcramai’s total aggregate liability arising out of or relating to the free Services will not exceed one hundred US dollars (USD 100), or the equivalent in your local currency — reflecting that the Free Web Scan is provided at no charge.

Nothing in these terms excludes or limits liability that cannot lawfully be excluded or limited, such as liability for death or personal injury caused by negligence, or for fraud. Some jurisdictions do not allow certain limitations, so parts of this section may not apply to you.

15. Indemnification

You will defend, indemnify, and hold harmless Qcramai and its officers, employees, and contractors from and against any claim, demand, proceeding, loss, liability, damage, fine, penalty, cost, or expense (including reasonable legal fees) arising out of or relating to: (a) your use of the Services; (b) any Scan Target you submit; (c) your breach of these terms, including any breach of the authorization and acceptable-use obligations in section 5; (d) your violation of any law or of any third party’s rights; or (e) any claim by the operator of a Scan Target relating to a Scan you initiated.

16. Suspension and termination

We may suspend or terminate your access to the Services at any time, with or without notice, including where we believe you have breached these terms or used the Services unlawfully. Sections that by their nature should survive termination — including sections 5–8 and 10–19 — will survive.

17. Changes to these terms

We may update these terms from time to time. The “last updated” date shows when. Material changes take effect when posted, and your continued use of the Services after that constitutes acceptance. If you do not agree, stop using the Services.

18. Governing law and disputes

These terms and any dispute arising out of or in connection with them or the Services are governed by the laws of [governing jurisdiction, e.g. India], without regard to its conflict-of-laws rules. The courts of [city / jurisdiction] have exclusive jurisdiction, and you consent to that venue. Any claim must be brought within one year of the event giving rise to it, to the extent permitted by law.

19. General

These terms, with the Privacy Policy and Disclaimer, are the entire agreement between you and Qcramai regarding the free Services and supersede any prior understanding. If any provision is held unenforceable, it is severed and the rest remains in force. Our failure to enforce a provision is not a waiver. You may not assign these terms; we may assign them to an affiliate or successor. Nothing here creates a partnership, agency, or employment relationship. Notices to you may be given through the site.

20. Contact

Questions about these terms: info@qcramai.com, or via the contact form. To report abuse of the Free Web Scan or to request removal of a Report relating to a system you operate, email info@qcramai.com with the details.