1What this is about
Hullwise only reads what a website serves to every visitor: the page itself and the JavaScript files it includes. Even so, a security check is different from a visit. It specifically looks for weaknesses and exposed keys. That is why these rules apply to every use, whether through the website, the API or the MCP server.
What the check itself never does:
- Try hidden paths or fetch files such as .env
- Load files that your site does not include itself, or read scripts from third-party domains
- Search for open ports (port scan)
- Submit forms or send attack code
- Sign in or use keys it finds
- Display or store the full values of keys it finds
- Check internal or private addresses
2Only your own or authorized sites
Only check sites that belong to you or your company, or for which you have the express permission of the operator. For clients, this means: obtain permission before you check.
A Security Audit in any case only begins once ownership of the domain has been proven.
3No mass scans of third-party sites
Do not use Hullwise to work through lists of third-party sites, for example to find vulnerable sites or exposed keys, to collect data or to publish rankings about others. This applies even if each individual request stays within the limit.
4Do not circumvent limits
In the browser and through the MCP server, 20 checks per hour are possible without signing in and without a key. With a free account or key, the limit is 100, and with Business 2,000. The REST API always requires a key. Do not circumvent these limits, for example with multiple accounts, many keys or changing IP addresses. The same applies to the shortened reports without a paid plan.
If you need more, write to us at cem@cdcapital-group.com.
5Use findings responsibly
Use findings to make sites more secure. Do not use them to attack a site, to try out keys you have found or to put pressure on operators. If you find something on someone else’s site, tell the operator confidentially.
6AI agents
If an AI agent performs checks through our MCP server or the API, the same rules apply. You are responsible for what your agent checks on your behalf. Only give it sites that you are allowed to check.
7What happens in case of violations
We may block keys, accounts and IP addresses, and in the case of serious violations also without prior warning. In such a case, we may terminate paid services. For more details, see the Terms of Service.
8Reporting abuse
If you suspect that someone is checking your site with Hullwise without permission, write to us at cem@cdcapital-group.com. Tell us the domain and, if possible, the time.
You can recognize our requests to the site and to its JavaScript files by this identifier in the user agent:
HullwiseScanner/1.0 (+surface check; read-only)
9Vulnerabilities in Hullwise
If you have found a vulnerability in Hullwise itself, please read Report a vulnerability.
10Changes
We update these rules when the service changes. The date at the top shows the current version.