Terms of Use

By accessing this site or hiring No Vuln's services, you agree to these Terms of Use and to our Privacy Policy. If you do not agree, do not use the site or hire the services.

No Vuln provides penetration testing, offensive security assessments, threat modeling and continuous security monitoring. The services are specialized and technical in nature, require a scope defined in advance in a written contract and are performed under a mutual NDA.

Prerequisites for execution:

• A signed mutual NDA
• A formal scope, documented and accepted
• Express written authorization from the client
• Payment of the kickoff installment as set out in the proposal

Language of documents: the proposal, contract and NDA are drafted in the client's language (Portuguese, English or Spanish); the final report is delivered in the language requested by the client.

• Provide true and complete information in the contact form
• Ensure you have the legal authority to commission a pentest of the target (only systems owned by the client)
• Read the delivered report in full and apply the recommended fixes
• Honor the NDA during and after the term of the contract
• Pay according to the schedule agreed in the proposal, under the conditions in section 7

Regarding pentest services: A pentest is an attack simulation with a defined scope, depth and duration. Even with the best methodology, there is NO absolute guarantee that EVERY existing vulnerability will be found. A pentest significantly reduces risk, but does not eliminate it entirely.

Regarding the site: The site is provided “as is”. We do not guarantee that it will be available 100% of the time or free of errors. Blog content is for informational purposes only and does not constitute legal, accounting or financial advice.

All information exchanged during a project is confidential and protected by an NDA. Security findings are not disclosed publicly without the client's express authorization. Client logos and names are displayed on the site only with written authorization.

Site content: All content on novuln.com.br — including text, images, code, the methodology described and the brand name — is the property of No Vuln. Quoting with attribution to the source is permitted; full reproduction without prior authorization is prohibited.

Delivered reports: Reports delivered to the client are for the client's internal use. They may not be republished or shared publicly without No Vuln's authorization, except when required by an auditor, by Brazil's data protection authority (ANPD) or Central Bank (BACEN), or by another regulatory authority.

Proprietary tools: No Vuln's internal arsenal (500+ proprietary tools and modules) is the exclusive property of the company. It is not licensed, sold or shared.

• Payment follows the schedule set out in the proposal (usually 50% upfront and the balance on delivery)
• International clients: invoiced in USD, paid via Wise or international wire transfer — 50% at kickoff and 50% on delivery
• Companies in Brazil: up to 3 interest-free installments on one-off pentest packages; invoicing exclusively with a Brazilian electronic invoice (NF-e), for which a CNPJ is required
• PTaaS (continuous pentest): monthly or quarterly hour bank; the minimum term and cancellation terms are set out in the commercial proposal
• Cancellation of a one-off project after it has started: the client pays in proportion to the work performed, with no refund of the upfront payment

No Vuln's liability is, in any event, limited to the amount paid for the contracted service. We are not liable for indirect damages, lost profits, loss of business opportunity or the consequences of security incidents that occur after the report is delivered, especially when the recommended fixes have not been applied by the client.

Found a vulnerability on novuln.com.br? Report it following our policy at /.well-known/security.txt. Researchers who follow the policy are covered by safe harbor — we will not take legal action over testing carried out in good faith.

These terms are governed by the laws of Brazil. The courts of the judicial district (Comarca) of São José do Rio Preto, State of São Paulo, Brazil, are chosen to settle any dispute, with express waiver of any other venue, however privileged it may be.

Questions about these terms: [email protected]