Acceptable use policy

We do offensive security work, so we are strict about where and how it is used.

Security testing needs written permission

We test a system only when the person or company that owns it has authorised the test in writing. Before any test, the client signs an authorisation that lists:

• The targets in scope: domains, IP ranges, apps and accounts
• The dates and hours of the testing window
• What is out of bounds, such as denial of service or social engineering
• Who to call on each side if something goes wrong

If a target is hosted by a third party, such as a cloud provider or a payment processor, the client is responsible for getting any permission that provider requires.

We stop and report straight away if we find signs of an earlier breach, illegal content or a risk to safety.

What you must not ask us to do

• Test systems you do not own or control
• Access accounts or data without the owner's consent
• Help with fraud, stalking, harassment or surveillance of individuals
• Hide a breach from people the law says must be told

We decline this work and may end an engagement if it comes up.

Using our notes and writeups

The notes on this site describe attack techniques so that teams can defend against them. Use them on systems you own or are allowed to test. Unauthorised access to computer systems is a crime in Ghana under the Electronic Transactions Act, 2008 (Act 772) and the Cybersecurity Act, 2020 (Act 1038), and under similar laws in most other countries.

Using this website

Do not:

• Attack, probe or overload the site, except as allowed by our disclosure policy
• Send spam or automated submissions through the brief form
• Copy the site in a way that passes it off as your own

Breaking these rules

We may block access to the site, end an engagement or report unlawful activity to the relevant authorities.

Questions: hello@gravexlabs.dev.