1. What Hackaiz analyses
- Public and private repositories explicitly authorized through GitHub App; no arbitrary GitHub links.
- Websites and APIs after DNS or HTTPS-file proof and an authorization declaration for the exact domain.
- Technical control proof does not replace a legal mandate; website analysis cannot see your code.
- Connected databases are audited read-only for structure and access rules, not business data.
- A mobile app (.apk or .ipa) is opened on your device and never uploaded.
2. What Hackaiz never does
- No destructive testing: no deletion, no data changes, no deliberate overload.
- No live database test without the owner's explicit approval, and always read-only.
- No direct website or customer database changes. GitHub PRs are proposed for review; Hackaiz never merges them or changes the default branch.
- No invented finding to push a purchase.
- Monitoring requires your agreement and current authorization; revoking proof or access blocks new analyses.
3. How a finding is proven
Every finding shows its raw evidence (code, URL, header, rule ID) and a confidence level. A weakly proven severe alert is shown lower and never triggers an alert email. An automatic check challenges weak findings (comments, demo code, unused code) and lowers their confidence without hiding them.
4. Honest limits
- Hackaiz complements a human penetration test; it does not replace it.
- When access is missing or a scan stops, the report says so and lists what was not checked.
- AI explanations are checked by rules, builds or tests; they are never a guarantee.
- A "Payment security" reading is indicative, not an official regulatory report.
5. Traceability
Actions and authorizations are recorded in a hash-chained log. Chaining helps detect alterations but is not independent anchoring or a guarantee of immutability. Retention policy and external anchoring remain subject to review.
6. Your data
- Detected secrets are masked in the interface and reports.
- Data is separated per account.
- You can revoke GitHub or Google at any time and request export or deletion of your data.
7. Verifiable commitments
Our approach is based on inspectable evidence, authorized analysis and traceable actions. The commitments described here concern how Hackaiz operates; they are not a compliance attestation. Any published certification or attestation will include its scope, issuing body and validity period.
8. Measuring quality
Every rule goes through a known-truth bench: real flaws confirmed by hand must be found and their safe variants must stay quiet. A new rule stays a "candidate" until it has at least 5 real cases, at most 10% false positives and at least 70% detection. Per-family rates will be published here once each family reaches that bar.
A sealed proof can be verified by an auditor on the "Verify a proof" page.
9. Report a vulnerability
Found a security issue in Hackaiz? Email contact@hackaiz.com with details. Please do not disclose it publicly before we reply.