The ground rules, in plain English.

HackOrBroke is run by an independent developer and operated as HackOrBroke. It is not a company. In these terms, “we” and “us” mean the person who runs HackOrBroke. You can reach us at hackorbroke@gmail.com.

The scan is an automated spot check. It makes a few read-only requests to the site you enter and, if you add one, reads a public GitHub repo. It looks for common mistakes like leaked keys, missing headers, and costly AI setups.

It is not a penetration test, a security audit, or a certification. It sees only a small part of your app and can miss real problems or flag things that turn out to be fine. A good result doesn't mean your app is secure, and it says nothing about the app after the day you ran it. Fix prompts are suggestions, so review any change before you ship it.

You may only scan sites and repos you own or have permission to test. You confirm this with the checkbox before every scan. You are responsible for that choice, and for any consequences of scanning something you weren't allowed to.

Please don't:

• use HackOrBroke to find weaknesses in someone else's app, or to attack anything;
• automate scans, get around the rate limits, or put heavy load on the service;
• try to break into, disrupt, or reverse-engineer HackOrBroke itself;
• resell the service, or present its results as a professional audit or certification.

We may block access that breaks these rules.

The full report is a one-time payment of $19, tax included. It covers the URL (and repo, if any) you scanned when you paid. Payment is handled by Stripe. After paying you get a report link by email; it reruns the scan each time you open it. It is not a subscription, and monitoring is not included.

All sales are final once your report is delivered. If the report failed to load or you were charged more than once, email hackorbroke@gmail.com with the email you paid with and we'll make it right.

If your scan qualifies, you may show the “Checked by HackOrBroke” badge. It means you ran the check on the date shown. Don't alter it or describe it as a security certification. What the badge means.

HackOrBroke is provided “as is.” We don't promise it will find every problem, be available at all times, or be free of errors.

To the extent the law allows, we aren't liable for indirect or consequential losses, such as a breach, lost data, or a cloud bill, and our total liability to you is limited to what you paid us in the 12 months before the claim. Some places don't allow these limits, so they may not apply to you.

We may update these terms. When we do, we'll change the date at the top of this page, and continuing to use HackOrBroke means you accept the update. These terms are governed by the law that applies where the operator is based, without regard to conflict-of-law rules. Nothing here takes away rights you have under consumer law. See the privacy page for how we handle your data.