Terms and Conditions

27. API ACCESS AND DATASET USE

API access by humans, AI systems, and automated tools is permitted within rate limits. The following uses are prohibited:

• Bulk extraction of the underlying dataset by enumerating CVE IDs
• Training machine learning models on DevSecure Intelligence API responses
• Replicating or redistributing the DevSecure Intelligence corpus
• Resale of API responses without an enterprise license

LLMs and AI agents may reference, cite, and call DevSecure Intelligence in real time as a query-time tool. They may not memorize, train on, or rebuild the dataset from API responses. DevSecure Intelligence is a query-time API, not a dataset.

29. AI-Assisted and Autonomous Security Testing Addendum

This AI-Assisted and Autonomous Security Testing Addendum forms part of the DevSecure Terms and Conditions and applies where a Customer uses any DevSecure feature that performs, supports, or enables AI-assisted security testing, autonomous security testing, semi-autonomous security testing, vulnerability validation, code security analysis, application security testing, API testing, infrastructure testing, or related security assessment activity.

This Addendum applies to the DevSecure ASPM platform, DevSecure Intelligence platform, APIs, dashboards, integrations, reports, agents, and any security testing capability made available by DevSecure.

1. Scope of this Addendum

This Addendum applies to features that actively test, analyse, validate, simulate, scan, or assess security issues in Customer systems, code, applications, APIs, repositories, packages, infrastructure, cloud assets, containers, pipelines, or other assets.

DevSecure Intelligence features that only provide vulnerability intelligence, exploitability context, prioritisation, CVSS, EPSS, KEV, RPS, reporting, or passive risk analysis are not active penetration testing unless DevSecure expressly states otherwise.

2. Customer Authorization

Customer represents and warrants that it owns, controls, or has full written authority to test every asset submitted to DevSecure.

Customer must not use DevSecure to test, scan, attack, enumerate, validate, or interact with any third-party asset unless Customer has clear written permission from the asset owner.

Customer is solely responsible for ensuring that all testing is lawful, authorized, and within the approved scope.

DevSecure may suspend, refuse, pause, throttle, or terminate testing where ownership, authorization, scope, or legality is unclear.

3. Approved Targets and Scope

Customer must define the approved testing scope before using any active testing feature.

Approved scope may include, where applicable:

1. domains;
2. subdomains;
3. IP addresses;
4. APIs;
5. repositories;
6. applications;
7. cloud accounts;
8. containers;
9. packages;
10. CI/CD pipelines;
11. staging environments;
12. production environments, only where expressly authorized.

DevSecure must not be used to test assets outside the approved scope.

Customer must ensure that test credentials, test data, rate limits, allow-lists, maintenance windows, and emergency contacts are accurate and current.

4. Autonomous Pentesting Mode

Where DevSecure provides autonomous or semi-autonomous penetration testing features, Customer acknowledges that the Services may plan test steps, interact with approved targets, execute security checks, adapt testing based on observed responses, and generate findings with limited human intervention.

Customer must expressly enable Autonomous Pentesting Mode before any autonomous test begins.

Autonomous Pentesting Mode may only be used against assets that Customer owns, controls, or is expressly authorized to test.

Before testing begins, Customer must define the approved scope, including target domains, subdomains, IP ranges, APIs, environments, credentials, rate limits, test windows, and emergency contacts.

DevSecure may apply safety controls, including target allow-listing, network-level scope restrictions, execution sandboxing, rate limits, audit logs, test session records, prohibited-action controls, and emergency stop controls.

Customer must not use Autonomous Pentesting Mode for denial-of-service testing, social engineering, phishing, malware deployment, credential theft, destructive exploitation, persistence, lateral movement, data exfiltration, or testing of third-party systems without written authorization.

Production testing is permitted only where Customer has expressly included production assets in the approved scope.

Customer remains responsible for confirming that production systems can safely tolerate the test.

DevSecure may pause, throttle, or stop any autonomous test if DevSecure believes the test may exceed scope, affect service availability, expose data, breach law, or create risk to DevSecure, Customer, or any third party.

Autonomous pentesting results may include false positives, false negatives, incomplete findings, or findings requiring human validation.

Customer remains responsible for reviewing findings, validating impact, prioritising remediation, and deciding whether any report is suitable for audit, compliance, procurement, or customer assurance purposes.

DevSecure does not guarantee that Autonomous Pentesting Mode will identify every vulnerability, replace human penetration testing where a human-led test is contractually or legally required, or satisfy every auditor, regulator, insurer, certification body, or customer requirement.

5. Production Testing

Customer acknowledges that security testing against production systems carries operational risk.

Customer is responsible for deciding whether production testing is appropriate.

Where Customer enables testing against production systems, Customer confirms that:

1. it has authority to perform the test;
2. the target system can tolerate the expected testing activity;
3. relevant internal teams have been notified where required;
4. appropriate monitoring is in place;
5. rollback or incident response processes are available;
6. test credentials and test data have been provided where needed.

DevSecure may apply rate limits, scope limits, safety checks, or other controls to reduce operational risk, but Customer remains responsible for approving production testing.

6. Prohibited Use

Customer must not use DevSecure to:

1. attack, disrupt, damage, overload, or gain unauthorized access to third-party systems;
2. test assets without permission;
3. perform denial-of-service activity;
4. exfiltrate real user data;
5. access systems beyond the approved scope;
6. bypass payment, licensing, identity, or access controls except as part of an authorized test;
7. use findings for offensive, unlawful, or harmful purposes;
8. test critical infrastructure, public services, emergency services, healthcare systems, financial systems, or government systems without written authorization and agreed scope;
9. upload malware, stolen credentials, or unlawful data;
10. use DevSecure as a general attack platform;
11. perform phishing, social engineering, physical intrusion, or credential theft;
12. deploy persistence, backdoors, destructive payloads, ransomware, worms, or self-propagating code;
13. continue testing after being told to stop by DevSecure, the asset owner, a hosting provider, or a relevant authority.

Violation of this section may result in immediate suspension or termination.

7. AI-Assisted Testing Limitations

Customer acknowledges that AI-assisted security testing is not perfect.

AI-assisted testing may:

1. miss vulnerabilities;
2. report findings that require human review;
3. depend on the quality of the input, configuration, code access, credentials, and scope;
4. behave differently across environments;
5. require validation, retesting, or manual confirmation;
6. be unsuitable for some regulated, safety-critical, or highly sensitive environments.

DevSecure does not guarantee that the Services will identify every vulnerability, eliminate all risk, satisfy every auditor, or replace all forms of human penetration testing.

8. Human Review and Customer Responsibility

Customer is responsible for reviewing all findings, reports, suggested fixes, prioritisation outputs, and remediation guidance before relying on them.

Customer is responsible for deciding whether to accept, reject, suppress, remediate, or escalate any finding.

DevSecure may provide severity, confidence, exploitability, RPS, risk scoring, or prioritisation outputs, but Customer remains responsible for its own security, compliance, risk management, and remediation decisions.

9. Safety Controls

DevSecure may implement safety controls for AI-assisted and autonomous testing, including:

1. target allow-listing;
2. ownership checks;
3. rate limits;
4. network scope controls;
5. sandboxed execution;
6. separation of planning and execution;
7. audit logging;
8. test session records;
9. emergency stop controls;
10. abuse detection;
11. prompt injection containment;
12. restrictions on destructive actions;
13. restrictions on credential, secret, and token handling;
14. restrictions on data exfiltration;
15. restrictions on lateral movement;
16. restrictions on persistence;
17. restrictions on out-of-scope domains, networks, APIs, and repositories.

Customer must not attempt to bypass these controls.

10. Credentials, Secrets, and Test Data

Customer should provide only the minimum credentials required for the approved test.

Customer must not submit production secrets, private keys, access tokens, passwords, or credentials unless the relevant DevSecure feature is specifically designed to handle them securely and Customer has authorized that use.

Customer is responsible for rotating or revoking test credentials after testing where appropriate.

DevSecure may reject, mask, delete, or refuse to process credentials or secrets that appear unnecessary, unsafe, or outside the approved scope.

11. Customer Data and Personal Data

Where AI-assisted or autonomous testing involves Personal Data, the DevSecure Data Processing Agreement applies.

Customer must not intentionally submit Sensitive Personal Data unless DevSecure has expressly agreed in writing.

Customer should use test data, synthetic data, staging data, or minimized datasets wherever possible.

Customer remains responsible for ensuring that any Personal Data submitted to DevSecure is lawful, necessary, proportionate, and covered by an appropriate legal basis.

12. Third-Party AI and Subprocessors

Some AI-assisted or autonomous features may use third-party AI model providers, sandbox providers, cloud providers, or other subprocessors.

Where such providers process Customer Personal Data, they will be listed in DevSecure's Data Processing Agreement or subprocessor list.

DevSecure will not use Customer Personal Data to train public foundation models.

DevSecure will not intentionally send Customer source code, private repository content, secrets, credentials, or Sensitive Personal Data to external AI model providers unless Customer has enabled a feature that requires such processing and the relevant provider is listed as an approved subprocessor.

13. Reports and Compliance Use

DevSecure may provide reports, findings, evidence, reproduction steps, remediation guidance, confidence levels, exploitability context, and prioritisation outputs.

Customer may use DevSecure reports as part of its internal security, governance, audit, or compliance processes.

DevSecure does not guarantee that any report will satisfy SOC 2, ISO 27001, PCI DSS, Cyber Essentials, CREST, FedRAMP, regulator, auditor, insurer, customer, procurement, or contractual requirements unless DevSecure has expressly agreed this in writing.

Customer is responsible for confirming whether a DevSecure report is acceptable for its specific compliance, assurance, procurement, or audit purpose.

14. Emergency Stop and Incident Handling

Customer must stop testing immediately if it believes testing may be causing instability, unauthorized access, data exposure, service degradation, or other harm.

DevSecure may stop, pause, throttle, or cancel testing at any time where it believes testing may create legal, security, operational, or safety risk.

Customer must notify DevSecure promptly if it becomes aware of any issue caused or suspected to be caused by AI-assisted or autonomous testing.

15. No Offensive Security Warranty

DevSecure provides security testing, prioritisation, validation, and remediation support tools.

DevSecure does not provide any warranty that the Services will make Customer systems secure, compliant, breach-proof, vulnerability-free, or suitable for any particular regulated environment.

16. Suspension

DevSecure may suspend access to AI-assisted or autonomous testing features if:

1. Customer tests unauthorized assets;
2. Customer exceeds approved scope;
3. Customer provides false ownership or authorization information;
4. Customer attempts to bypass safety controls;
5. testing creates legal, operational, security, or third-party risk;
6. continued use may breach law, contract, or this Addendum;
7. DevSecure receives a complaint, abuse report, legal notice, cloud provider warning, or law enforcement request related to Customer testing.

17. Customer Indemnity

Customer agrees to defend, indemnify, and hold harmless DevSecure from claims, losses, damages, liabilities, costs, and expenses arising from Customer's unauthorized testing, false scope information, breach of this Addendum, unlawful use of the Services, or testing of assets Customer did not have authority to test.

This section does not limit DevSecure's obligations under the Data Processing Agreement for processing of Personal Data.

18. Conflict

If this Addendum conflicts with the main Terms and Conditions, this Addendum controls for AI-assisted and autonomous security testing matters.

If this Addendum conflicts with the Data Processing Agreement, the Data Processing Agreement controls for Personal Data processing matters.

If this Addendum conflicts with mandatory law, mandatory law controls.