Disclaimer

Effective 27 August 2026.

This page sets out what our products, our documentation, our writing and our numbers can and cannot be relied on for.

It is not a way of avoiding responsibility for what we do. It is a way of being clear about where responsibility sits, before it matters.

1. What this covers

Everything we publish and everything we run: the products, this documentation, our public websites, our research writing, our pricing and calculators, and anything our people say in support of them.

It sits alongside the Terms of Service, which is the agreement that actually binds us, and it does not enlarge or reduce anything in it. Where this page and the Terms say the same thing, the Terms are the version that governs.

2. Finding nothing is not the same as being secure

Our products look for weaknesses in systems. They will not find all of them.

A clean result means our tools did not find a problem in what they were pointed at, using the techniques they had, at the time they ran. It does not mean the system is secure, that it has no vulnerabilities, or that it will still be in the same state tomorrow. Anyone who tells you a scanner proves a negative is wrong.

Findings can also be wrong in the other direction. Automated testing produces false positives, misjudges severity, and reports things that are real but do not matter in your environment. Every finding needs a human to decide what it means. The output is an input to your judgement, not a replacement for it.

We do not warrant the accuracy, completeness or severity of anything our products report, and you should not present our output to a customer, a board or a regulator as though we had.

3. Autonomous work happens inside the scope you set

Some of our products act on their own. They decide what to do next, and they do it, without asking.

They do that inside the scope you give them. Getting the scope right is yours, and so is holding the authorisation that makes the testing lawful. A target you added by mistake looks exactly like a target you meant, to us and to the tool.

Section 7 of the Terms is the binding version of this.

4. Nothing here is advice

Nothing we publish is legal, regulatory, financial, tax or professional advice, and reading it does not create a professional relationship between us.

Using our products does not make you compliant with any standard, framework, certification or regulation. We do not certify anyone, we do not audit anyone, and a report our tools produced is not an attestation. If you need one, you need an assessor.

Where we sell is not a statement about your law. Our Where we sell page describes where we can lawfully and practically supply, based on what binds us as an Indian company. For a large group of countries it says plainly that we do not know your local law on buying and running security testing tools. That is not modesty, it is the actual position: we cannot check it for you and we cannot advise you on it. Being able to complete a purchase is not us telling you the purchase is permitted where you are.

5. Our research and writing

We publish security research, technical writeups and vulnerability analysis.

It is published to help defenders, and it describes things that can be misused. Publishing an attack is not an invitation to run it. Nothing we publish is authorisation to test anything, and a technique being written up on our blog is not a defence to using it on a system you do not have permission to touch.

Research is accurate to the best of our knowledge on the day it goes up. Software changes, vendors patch, and our conclusions can be overtaken or turn out to have been wrong. We correct what we find, and we do not silently rewrite history — a correction is marked as one.

Naming a vendor, a product or a vulnerability is not a claim about that vendor’s overall security, and it is not an accusation against anyone.

6. Documentation

Our documentation describes how our products behave now. Products change, and a page can be behind the software it documents.

Where a page says a thing exists that you cannot find, or a page contradicts what the product does, the product is the truth and the page is a bug — tell us at support@mail.defaultred.com.

Examples, sample configurations and code in the documentation are illustrations. They are not production-ready, they are not security-reviewed for your environment, and running one without reading it is your decision.

7. Numbers, calculators and examples

We do not publish statistics about ourselves that we cannot source. No customer counts, no vulnerabilities-found totals, no adoption figures invented to fill a page. If you cannot find a number like that on our site, that is deliberate.

Calculators run on the numbers you type. Where we offer one — pricing, savings, earnings — it computes from your inputs and its assumptions are stated next to it. The result is arithmetic on what you told it. It is not a forecast, not a quotation, and not a promise of a result, and changing an input changes the answer.

Prices shown outside checkout are indicative. The price that binds is the one at the point of purchase, in the currency shown there, plus tax.

Earnings from our affiliate and advertising programs are not guaranteed. What anyone else earned is not what you will earn.

8. Things we say are coming

We talk about what we are building. Roadmaps, previews, betas, “coming soon” and anything else about the future are statements of current intention, not commitments.

Features get delayed, redesigned and cancelled. Do not buy something because of what it is going to do. Buy it for what it does today; anything else is a bet you are making, not one we are underwriting.

We are still launching. Parts of Default RED are in testing and may run at reduced capacity, or not be available at all, in a country we otherwise sell to.

9. Other people’s things

Links. Our sites link to places we do not run. We do not control them, we do not review them, and a link is not an endorsement.

Advertising. Ads on our surfaces are the advertiser’s claims, not ours. We do not verify them. Your dealings with an advertiser are between you and them.

Third-party software. Our products work with, and sometimes bundle, software from other people. Their licences and their terms govern their software, and we do not warrant it.

Content other users publish — bug bounty program descriptions, listings, profiles — belongs to whoever wrote it. Hosting it is not agreeing with it.

10. Availability

We try to keep everything running and to say so when it is not. We do not promise an uptime figure and, unless a signed agreement gives you a service level, downtime does not earn credits.

11. Marks

Default RED™ and our logo are our trade marks. Other names and marks on our sites belong to their owners, and using one to describe or discuss their product is not a claim of affiliation with them or an endorsement by them.

12. Where this leaves you

Nothing on this page excludes liability we cannot lawfully exclude, and nothing on it displaces section 16 or section 17 of the Terms of Service, which are where the exclusions and the liability cap actually live.

If something here is unclear, or you think it is wrong, email legal@defaultred.com.