Responsible Scanning Policy

1. Authorization is required before you scan

• Only scan assets you own, or that you have current, documented authorization to test from the owner.
• The authorization must name the targets and the time window. A verbal approval is not enough; keep it in writing.
• If the target is hosted by a third party or cloud provider, confirm that your authorization covers testing from their terms, and obtain any consent they require.
• You, as the customer, are responsible for the lawfulness of each target you add to a project, and you represent that you hold this authorization.

2. Define and respect scope

• Configure scope precisely: hostnames, IP ranges, and API base URLs, using allow-lists rather than broad ranges.
• Exclude out-of-scope hosts, production systems that must not be touched, and any shared infrastructure the owner has not authorized.
• Never use Eresus Guard to scan a third party that the authorizing party does not control.
• Re-check scope when the target infrastructure changes, so an old IP does not point at a system you were never authorized to test.

3. Run scans safely

• Choose scan profiles that match the authorization. Avoid high-rate or aggressive profiles against fragile or production systems unless the owner has agreed to the impact.
• Prefer non-destructive checks. Do not attempt to exfiltrate real data, pivot into unrelated systems, or persist access beyond proving the finding.
• Use the lowest privilege and the narrowest credentials that still prove the issue.
• Stop immediately if a scan causes unexpected load, instability, or a suspected outage, and tell the owner.
• Do not use Eresus Guard to conduct denial-of-service, volumetric, or destructive testing.

4. Handle what you find responsibly

• Any real personal data, credentials, or secrets you encounter are handled within your workspace under the Data Processing Addendum and your own obligations.
• Do not copy discovered secrets or personal data outside your workspace.
• If you discover a vulnerability that affects a system beyond your authorized scope, do not exploit it further; report it to the owner.
• Follow the responsible-disclosure expectations of the target owner for anything you find in their systems.

5. Prohibited conduct

The Acceptable Use Policy applies in full. In particular, you must not scan without authorization, scan a system you do not control, conduct destructive or denial-of-service testing, attempt to reach another customer’s workspace, or use the platform to attack a third party. We may suspend a workspace and report conduct where we have a legal duty to do so.

6. If something goes wrong

• Stop the scan immediately.
• Notify the target owner without undue delay, and keep the evidence you need to explain what happened.
• Notify us at security@eresussec.com so we can help you contain and assess the impact.
• Preserve relevant logs; do not delete evidence that may be needed for the incident record.