EXP Exposight

Terms & Acceptable Use

Last updated: 2026-10-05

1. Only scan what you own or are authorised to test

Exposight actively probes hosts and ports. You may add and scan a domain only if you own it or have written permission from its owner to test it. Before any active scan, a domain must be verified. Normally you prove control by publishing a DNS TXT record at _exposight-challenge.<your-domain>. The operator of this service can also verify a domain manually for a limited period (1 to 90 days); that override expires on its own.

Exposight re-checks the DNS record about once a day. If the record is missing, it checks again about an hour later. A domain stops being verified, and its scans stop, after two definite misses in a row, so about a day after the record is removed. A failed or inconclusive DNS lookup does not count as a miss.

2. Prohibited use

  • Scanning, probing or monitoring systems you are not authorised to test.
  • Using Exposight to attack, disrupt or overload any system, or to evade rate limits, bot protection or a web application firewall.
  • Sharing invite tokens or accounts with people who are not allowed to see your organisation's data.
  • Trying to access another organisation's data, or to bypass the limits and quotas of the service.

If a domain is reported for misuse, the operator can revoke its verification, which blocks further scans of that domain.

The operator can also suspend an account. A suspended account cannot use the dashboard or the API; every signed-in request is refused with "Account suspended". In each organisation where every owner is suspended, scan schedules are turned off and scans that are still queued are cancelled; scans already running finish. Lifting the suspension restores access, but schedules stay off until an owner turns them on again. The operator's reason for a suspension is not shown to the account or to its organisations.

3. What Exposight stores

  • Your account: the user ID and email address from the sign-in provider, when you were first seen and when you were last seen, and, if the account is suspended, when and why (the reason is visible only to the operator).
  • Organisations, memberships and roles.
  • Invites: the invited email address, the role, a hash of the invite token (never the token itself), who sent it, and when it was created, accepted or revoked.
  • Domains: the name, verification state and token, scan schedule and alert settings, including the alert recipient email addresses you configure.
  • Scan results: discovered subdomains, hosts, open ports, TLS and HTTP header findings, risk scores and detected changes.
  • Alert notifications: recipient, subject, body, delivery status, number of attempts and the last delivery error.
  • An append-only audit log of security-relevant actions (who did what, to which object, and when). Audit log entries do not contain email addresses.

Server logs (container output) record requests, including client IP addresses and paths. The API, worker and admin tool mask email addresses, tokens and other secrets in their logs before writing them. The database server's own error log can still contain values from a failed database statement. Rate-limit counters are kept only in memory and are not stored.

4. Data retention

You can delete your own account with the API (DELETE /me); there is no dashboard button for this yet. Deleting it removes your account, your memberships and every invite sent to your email address. It is refused while you are the only owner of an organisation: make another member an owner, or delete that organisation, first. A suspended account cannot delete itself: its deletion requests go to the operator (see Contact), who decides on them.

Your sign-in provider account is not deleted with it, because Exposight cannot delete sign-in accounts. If you sign in again, a new, empty Exposight account is created. To have the sign-in account removed as well, ask the operator (see Contact).

An owner can delete an organisation with the API (DELETE /orgs/<id>). It is refused while one of its scans is running; queued scans and scan schedules are cancelled with the deletion. This deletes its domains, scan results, detected changes, alert notifications, memberships and invites. The organisation's audit log is kept, under the name deleted-org-<id>; nobody can open it from the dashboard or the API.

Kept after a deletion: audit log entries, which identify the acting account by its user ID, never by email address; and email addresses that other organisations entered as alert recipients, with the alert notifications sent to them.

An automatic purge exists, but it is off unless the operator turns it on. When it is on, it deletes finished scans older than 180 days (each domain's latest successful scan, and any scan that a stored change is compared against, are always kept), sent or failed alert notifications older than 90 days, and invites 30 days after they were accepted, revoked or expired. Audit log entries are never purged. Everything else is kept until it is deleted.

5. Limits

Requests are rate limited. When a request rate limit is reached, the service answers 429 Too many requests with a Retry-After header. Domains per organisation, organisations per user and manual scans per domain per hour also have limits; reaching one of these returns an error that names the limit. Alert emails are limited per domain per day: emails over that limit are delayed until the limit allows them, not dropped and not reported as an error.

6. No warranty

Exposight is an independent portfolio project provided “as is”, without any warranty. Scan results can be incomplete or wrong; they do not replace a professional security assessment.

7. Contact

Report security vulnerabilities privately through GitHub private vulnerability reporting, never in a public issue (see SECURITY.md in the repository). For questions and data deletion requests, open an issue at github.com/vigneshs-17/exposight/issues; do not include personal data in a public issue.