keybrum
Log inCheck my app

Terms of service

Last updated 4 November 2026. These terms apply when you use Keybrum. They are written to be read: if something is unclear, write to [email protected].

1. The service

Keybrum (“we”) attacks web applications from the outside, on behalf of their owners, to prove which data and keys a stranger can reach. It reports findings with proof, suggests fixes, and retests them. By creating an account you accept these terms, the acceptable use policy and the privacy policy.

2. Your account and workspace

You sign in with Google or GitHub. You are responsible for what happens in your account and in the workspaces you own, including what members you invite do. Keep API keys secret: anyone with one can read your findings and start attacks on your verified apps. Revoke a key in Settings as soon as you suspect it leaked.

3. What you may test

You may only add apps you own, or that their owner has authorized you in writing to test. Proving control of an app in Keybrum (a tag, a DNS record or a file) is a technical check; it does not replace that authorization. Agencies may test client apps with the client's permission.

Your app may run on services you don't own, such as a hosting platform, Supabase, Firebase or an AI provider. You are responsible for making sure testing your own app complies with their terms. Keybrum's tests are designed to be light and non-destructive (see security), but you choose which apps are tested and which optional tests are on.

4. What results mean

Keybrum reports what its attacks proved on the date they ran. A run where no attack worked means those attacks failed then; it is not a guarantee that the app is secure, and Keybrum never says it is. Fix prompts are suggestions: review changes before you deploy them. The service is provided “as is”, without any warranty that it will find every weakness or run without interruption.

5. Your data

You keep all rights to your apps, your data and your findings. We use them to provide the service. We also use anonymized, aggregated statistics (for example, how often an attack works per builder and backend) to improve the attack library and to publish research. Those statistics never name an app, a workspace or a person. How we handle personal data is in the privacy policy.

6. Plans and payment

  • The preview of what a browser sees is free. A one-time report is paid once, covers one full attack run of one app and retests of its findings for seven days, and does not renew. Plans are billed monthly or yearly, in advance, and renew until you cancel.
  • If a paid attack run cannot complete because the app is unreachable, it is not used up and can be started again.
  • Payments are processed by Polar, our merchant of record, which charges your card, issues invoices and handles VAT. Polar's terms apply to the payment.
  • An upgrade takes effect at once and is charged the difference for the current period. A downgrade is credited on the next invoice.
  • You can cancel at any time from Settings. The paid plan stays active until the end of the period you paid for; we don't refund partial periods, except where the law requires it.
  • We may change prices for future periods. We will tell you at least 30 days before a change applies to your plan.
  • If the workspace has more apps or members than its plan allows (after a downgrade, for example), nothing is deleted, but you can't add more until you are within the plan.

7. Suspension and closing

We may pause attacks, or suspend an account, if we reasonably believe it breaks these terms or the acceptable use policy, puts an app or its users at risk, or if we receive a credible abuse report. When we can, we tell you first and give you the chance to explain.

You can delete your workspace or your account at any time from Settings. Deleting removes the apps, findings and history of the workspaces that are deleted with it.

8. Liability

To the extent the law allows, we are not liable for indirect or consequential losses, such as lost profit or data, and our total liability for any claim is limited to the amount you paid us in the twelve months before it. You are liable for testing an app you were not authorized to test. Nothing in these terms limits liability that cannot be limited by law, or your rights as a consumer.

9. Changes to these terms

We will announce material changes by email or in the app at least 30 days before they apply. If you don't agree, you can close your account before then. Questions: [email protected].