Terms of Service

Last updated: 31 October 2026

1. The service

HolicSecurity is a service of HolicAudit ("we"). It provides a one-off passive security exposure audit of a website you name ("you"), delivered as a PDF by email. What each tier includes (Basic $39, Standard $79, Plus $149) is listed in the pricing section of our home page at the time you order. The audit is not a penetration test, a vulnerability assessment of your application or infrastructure, or a compliance certification.

2. Authorisation and ownership

• By ordering, you confirm that you own the website and domain you name, or that you have the owner's written permission to order this audit on their behalf. You're responsible for that confirmation being true.
• Before any testing starts, we verify control of the domain. You can do this with a DNS TXT record (holicaudit-verify=<token>) or a file at /.well-known/holicaudit.txt containing the token we send you. Each hostname in your order must be verified, or must sit under a verified domain.
• If ownership can't be verified within 7 days of your order, we don't test the site and you get a full refund.
• We decline orders for sites that appear to belong to someone else, such as competitors, and refund them in full.

3. What we do, and what we never do

We send a short, fixed list of ordinary requests to the hostnames you verified, at no more than one request per second. We use a user agent that identifies us (HolicSecurity-PassiveAudit/1.0), and we log every request and print the log in your report. We read public pages, response headers, the TLS handshake and public DNS records. We check whether a fixed list of well-known sensitive files exists, reading at most 256 bytes to confirm, and we keep only a yes/no result, never the contents. We match software versions that your site announces publicly against the NVD and OSV.dev databases.

We never exploit vulnerabilities, send attack payloads, guess or try passwords, log in, fuzz, brute-force directories, run aggressive scanner modes or load-test. For Plus, we may list hostnames that appear in public certificate-transparency logs. We don't send requests to any hostname you didn't name and verify.

4. Ordering and payment

• Orders go through the shared HolicAudit order page, which gives you an order number and an exact amount to pay. The amount is the tier price plus a few cents, so we can match your payment.
• We accept USDT on the TRC20 (Tron) network only, sent to the address shown on the order page. Funds sent on another network or as another token can't be recovered, and we aren't responsible for them. You pay any network fee.
• We also accept PayPal in US dollars to paypal.me/maicoden, the PayPal link shown on the order page, with your order number in the payment note. PayPal processes the payment under its own terms; we confirm it by hand, usually within a few hours. You pay any fee or currency conversion PayPal charges you as the sender.
• Your order is confirmed once we've confirmed your payment (on the Tron blockchain for USDT, or in our PayPal account for PayPal). The full HolicAudit payment terms also apply.

5. Delivery, refunds and revisions

• 48 hours: we deliver your report by email within 48 hours of the later of (a) your payment being confirmed and (b) successful ownership verification. If we don't, you get a full refund in USDT, sent to the address you paid from or to another TRC20 address you give us in writing; if you paid with PayPal, the refund goes back to your PayPal account.
• One free revision: if something in the report is wrong or unclear, tell us within 14 days of delivery and we'll revise it once at no cost.
• Re-checks included in Standard and Plus must be requested within the period stated for your tier. They repeat the same passive checks on the same verified hostnames.

6. No guarantee of security

A passive audit can only see what your site shows the public at the time of the check. It cannot prove that a site is secure, and a report with no high-severity findings doesn't mean there are no vulnerabilities. Hidden software versions, application logic, authenticated areas, server internals and third-party services are outside its scope. When we say a software version is "listed as affected" by a CVE, that comes from public databases. We haven't tested whether it can be exploited, so confirm it with your vendor's advisory. Fix snippets are examples that you or your developer must review and test before deploying, and you're responsible for changes you make to your site.

7. Liability

To the extent the law allows, our total liability for any order is limited to the amount you paid for it. We aren't liable for indirect or consequential losses, including any security incident, data loss or downtime, whether or not it relates to something the report did or didn't mention.

8. Your report and confidentiality

Once paid for, the report is yours to use and share inside your business. We treat your findings as confidential, never publish them or name you as a customer without your permission, and delete scan data 90 days after delivery (see Privacy).

9. AI assistance

Data collection is automated. Findings come from fixed rules, and the explanations are written with AI assistance. Each finding is checked against the raw evidence printed in the report.

10. Changes and contact

We may update these terms. The version in force when you paid applies to your order. Questions: holicaudit@mail.grokbot.com.