Do
- Scan only domains and endpoints you own or are expressly authorized to test.
- Use the result for defensive planning, ownership conversations and evidence gathering.
- Stop and report unexpected behavior instead of increasing volume or scope.
- Use the system owner's disclosure channel when you suspect a vulnerability.
Do not
- Use Q-Ready to scan private, internal, loopback, link-local or cloud metadata addresses.
- Attempt login, exploit, fuzz, bypass controls, enumerate private services or download application data.
- Submit passwords, private keys, API tokens, secrets, personal data or confidential information.
- Bypass rate limits, rotate identities to evade limits or interfere with endpoint availability.
Abuse and opt-out
For suspected abuse, a request to stop a check or a question about a report, email support@aiagents007.tech with the hostname and report ID if available. Do not include credentials or secrets.