Terms of Service

1.Agreement and Acceptance

These Terms of Service (the "Terms") are a binding agreement between you and WEB CODE STORE (PVT) LTD ("Bug Circuit", "we", "us", or "our"), operator of the Bug Circuit platform and services at bugcircuit.com (the "Service"). They govern your access to and use of the Service.

By creating an account, submitting a domain, recording an Authorization to Test, purchasing a plan, or otherwise using the Service, you agree to these Terms. If you do not agree, do not use the Service.

These Terms incorporate by reference our Acceptable Use Policy and our Privacy Policy. If you accept these Terms on behalf of an organization, you represent that you are authorized to bind that organization, and "you" refers to that organization.

2.Eligibility

The Service is intended for business and professional use only. It is not a consumer product and is not directed to personal, family, or household use.

To use the Service you must be at least 18 years old and capable of forming a binding contract. You must not use the Service if you are barred from doing so under any applicable law, sanctions regime, or export control.

You are responsible for ensuring that your use of the Service, and the testing you authorize, is lawful in your jurisdiction and in any jurisdiction connected to the domains you submit.

3.Accounts and Login

You access the Service using a passwordless login: we send a one-time code to your business email address, and you sign in with that code. You are responsible for maintaining control of, and the security of, the email account associated with your Bug Circuit account.

You must provide accurate account information, including a valid business email and your organization name, and keep it current. You are responsible for all activity that occurs under your account.

Notify us promptly at [email protected] if you suspect any unauthorized access to your account or email. We may take reasonable steps to protect the Service, including suspending access, where we detect suspicious activity.

4.The Service and Plans

Bug Circuit provides manual security assessments of a customer's own web domain. All security testing is performed manually by human security engineers. Only the initial passive reconnaissance is automatic and passive — namely subdomain discovery via certificate-transparency logs and public DNS, technology fingerprinting from a single homepage request, and review of DNS and email posture such as SPF and DMARC. Passive reconnaissance never attacks, exploits, or attempts to compromise your site.

Each plan covers one domain. We currently offer:

• PULSE (free): a manual yes/no verdict on whether the site has any critical vulnerabilities, reviewed in our standard queue (not prioritized). No written report is provided.
• CIRCUIT ($49, one-time): a manual security audit by a human engineer, with a full written report of every vulnerability found.
• SIGNAL ($299): the same manual audit as CIRCUIT, plus remediation of the high and critical issues we identify and 3 months of security cover. Cover extends in 3-month blocks at +$36 per block.

Both paid plans (CIRCUIT and SIGNAL) include premium support and a named point of contact. Plan features, availability, and pricing may change as described in the "Changes to These Terms" section, but changes will not alter the core scope of an assessment you have already purchased.

5.Authorized Testing Only; Domain Warranty

Before any active testing of a domain, you must (a) prove ownership or control of that domain by one of our supported methods — a one-time code sent to a role address such as security@ or admin@, a DNS TXT record, a /.well-known file, or a homepage meta tag — and (b) record a click-through "Authorization to Test".

By submitting a domain and recording the Authorization to Test, you represent and warrant that you own the domain or are duly authorized by its owner to instruct security testing of it and everything served from it, and that such testing will not violate the rights of any third party or any agreement or law that applies to you.

You are solely responsible for the accuracy of your ownership proof and authorization. We rely on your representations. If your authorization lapses, is revoked, or was never valid, you must immediately stop using the Service in relation to that domain and notify us.

6.Acceptable Use

Your use of the Service is subject to our Acceptable Use Policy (the "AUP"), which is incorporated into these Terms. The AUP describes conduct that is prohibited, including submitting domains you are not authorized to test, using the Service to attack or disrupt third parties, and interfering with the integrity or security of the platform.

Without limiting the AUP, you agree not to: (a) use the Service other than for a domain you own or are authorized over; (b) attempt to access data or accounts that are not yours; (c) reverse engineer, scrape, or overload the Service; (d) resell or provide the Service to a third party without our written consent; or (e) use the Service to violate any law.

A breach of the AUP is a breach of these Terms and may result in suspension or termination under the "Suspension and Termination" section.

7.Fees, Billing, and Vouchers

PULSE is free. CIRCUIT is a one-time fee of $49. SIGNAL is $299 and includes 3 months of security cover; additional cover is billed in 3-month blocks at +$36 per block. All fees are stated in the amounts shown at checkout and are exclusive of any taxes, which are your responsibility unless stated otherwise.

Payments are taken through our online checkout, which supports discount vouchers. Card and account details are handled by third-party payment processors (for example, PayHere and PayPal); Bug Circuit does not store your full card number, and your use of the payment processor is subject to its own terms. Prices are shown in your local currency where we can determine it — Sri Lankan rupees (LKR) for customers in Sri Lanka, and an approximate local estimate elsewhere. Your order is settled (actually charged) in LKR for customers in Sri Lanka and in US dollars (USD) for customers in other countries; the exact amount and currency you will be charged are shown to you at checkout before you pay. Charges appear on your statement as "Web Professional Service".

Fully-covered ($0) orders — for example, an order reduced to zero by a valid voucher — activate instantly. Other paid orders are confirmed by our staff before the assessment begins; confirmation is not automatic. We may decline or cancel an order, for example where we cannot verify authorization or suspect fraud or abuse of a voucher.

Except where required by law, one-time assessment fees are non-refundable once the assessment work has begun. Vouchers have no cash value and may be subject to additional conditions stated at the time of issue.

8.Delivery of Services

Bug Circuit provides digital services only; no physical goods are sold or shipped. Access to your plan is provisioned electronically and is effectively immediate once your payment is confirmed — your plan activates on your account and you can request your assessment.

The manual security assessment and its written report are delivered to you digitally, ordinarily within a few business days of a security engineer beginning work, and you are kept updated in your dashboard and by email as your request moves through our queue. Timeframes are estimates and may vary with scope and demand.

Because delivery is electronic, there is no shipping, courier, or physical return process. Refunds and cancellations are governed by our Refund & Cancellation Policy.

9.Intellectual Property and Findings Reports

As between the parties, you retain all rights to your data — including your organization details, verified domains, scan requests, and the underlying facts about your own systems. We do not claim ownership of your data.

We own and retain all rights in the Service, including the Bug Circuit platform, software, methodologies, and brand. Except for the rights expressly granted here, no license to our intellectual property is granted to you.

The written findings report we produce for you (under CIRCUIT or SIGNAL) is licensed to you on a non-exclusive, non-transferable basis for your internal business use, including sharing it with your own advisers and, where relevant, your affected users, provided you do not remove attribution or misrepresent its contents. We may use aggregated and de-identified information about assessments to improve the Service, provided it does not identify you or your systems.

10.Confidentiality

In providing the Service we may learn sensitive information about your systems, including vulnerabilities and findings. We will treat your findings and non-public assessment information as confidential and use them only to provide and support the Service, except where disclosure is required by law.

You will keep confidential any non-public information about the Service that we designate as confidential or that a reasonable person would understand to be confidential, including our methodologies and non-public documentation.

These confidentiality obligations do not apply to information that is or becomes public through no fault of the receiving party, was already lawfully known, or is independently developed without use of the other party's confidential information.

11.Disclaimers; No Guarantee of Finding All Vulnerabilities

Security testing is inherently limited. A manual assessment reflects the state of a target at a point in time and the scope agreed. We do not and cannot guarantee that we will find all vulnerabilities, that a site is free of vulnerabilities, or that your systems are secure or cannot be compromised. A "no critical bugs" verdict or a clean report is not a warranty of security.

For SIGNAL, our remediation of high and critical issues and the provision of security cover are performed with reasonable skill and care but do not guarantee that your systems will be free from future compromise, new vulnerabilities, or issues outside the agreed scope or introduced after our work.

Except as expressly stated in these Terms and to the maximum extent permitted by law, the Service is provided "as is" and "as available", and we disclaim all warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. You remain responsible for your own security decisions and for acting on our findings.

12.Limitation of Liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, data, goodwill, or business, arising out of or relating to the Service or these Terms, even if advised of the possibility of such damages.

To the maximum extent permitted by law, our total aggregate liability arising out of or relating to the Service and these Terms will not exceed the greater of (a) the total fees you paid to us for the Service in the 12 months before the event giving rise to the liability, or (b) one hundred US dollars ($100).

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, such as liability for death or personal injury caused by negligence or for fraud. The limitations in this section allocate risk between the parties and are a fundamental basis of our bargain.

13.Indemnity

You will defend, indemnify, and hold harmless Bug Circuit and its officers, employees, and agents from and against any third-party claims, losses, liabilities, damages, and reasonable costs (including legal fees) arising out of or relating to: (a) your breach of these Terms or the Acceptable Use Policy; (b) your submission of, or instruction to test, any domain you did not own or were not authorized to test; (c) your misuse of the Service or any findings; or (d) your violation of any law or the rights of any third party.

We will notify you of any such claim, allow you to control the defense (with counsel reasonably acceptable to us), and reasonably cooperate. You may not settle any claim in a way that imposes obligations on us or admits fault on our behalf without our prior written consent.

14.Suspension and Termination

You may stop using the Service at any time. Because assessments are largely one-time engagements, closing your account does not entitle you to a refund of fees already earned. For SIGNAL, security cover runs for the period purchased and will not renew unless you extend it.

We may suspend or terminate your access, in whole or in part, immediately and without liability if: (a) you breach these Terms or the AUP; (b) we reasonably believe you have submitted a domain without authorization; (c) your use poses a security, legal, or operational risk; or (d) we are required to do so by law. Where practicable and appropriate, we will give notice and an opportunity to cure.

On termination, your right to use the Service ends. Sections that by their nature should survive — including intellectual property, confidentiality, disclaimers, limitation of liability, indemnity, and governing law — survive termination. We handle your data after termination as described in our Privacy Policy, subject to our append-only audit log and legal retention obligations.

15.Changes to These Terms

We may update these Terms from time to time. If we make material changes, we will take reasonable steps to notify you, such as by email to your account address or a notice within the Service, before the changes take effect.

Changes are effective on the date stated in the updated Terms. Your continued use of the Service after changes take effect constitutes acceptance of the updated Terms. If you do not agree to the changes, you must stop using the Service.

16.Governing Law and Disputes

These Terms and any dispute arising out of or relating to them or the Service are governed by the laws of Sri Lanka, without regard to its conflict-of-laws rules.

The parties will attempt in good faith to resolve any dispute informally before commencing formal proceedings. Subject to that, the parties submit to the exclusive jurisdiction of the courts of Sri Lanka for the resolution of any dispute, except that either party may seek injunctive or equitable relief to protect its intellectual property or confidential information in any court of competent jurisdiction.

If any provision of these Terms is held unenforceable, the remaining provisions remain in full effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets.

17.Contact

For questions about these Terms or the Service, please contact us:

• General and support: [email protected]
• Privacy: [email protected]
• Legal: [email protected]
• Security: [email protected]

WEB CODE STORE (PVT) LTD, a company registered in Sri Lanka. Company Registration No.: PV 00318975.