How gethacked.ai handles engagements.

Testing is performed only on systems the client owns or is explicitly authorized to have tested.

Every engagement starts with a written agreement of scope. The agreement names what we may test, what we may not, and what counts as out-of-bounds. We do not start work until that agreement is signed.

You decide what gets looked at, what gets found, and what gets fixed.

Scope is agreed in writing before any testing starts. If we reach something that sits outside it, we stop and tell you rather than following the thread.

You decide what to fix and in what order. We will tell you what we would fix first and why. The order is yours.

Your findings stay yours. We do not publish anything about your product without your written permission.

To do the work, we receive what the customer chooses to share: access to systems in scope, documentation, and contact details for the people we work with. We do not collect anything outside of what the engagement requires.

Findings are written for the customer first and any audience they choose second. We never publish a customer’s findings without explicit permission, and we never publish the underlying evidence at all.

Anything we write about findings in public (this website, our social channels, talks) is sanitized and labeled. A real customer never appears as a case study unless they have agreed in writing.

If you have found a security issue affecting gethacked.ai, we would like to hear about it. See our Responsible Disclosure page for the contact channel (see Responsible Disclosure below) and the kind of report that helps us respond quickly.

• No advertising trackers, session-replay, or fingerprinting.
• No third-party scripts beyond fonts self-hosted via Next.js.
• Subresource Integrity where any third-party asset is added.
• Strict Transport Security, Content Security Policy, and standard hardening headers (see response headers).