Terms of Service

Effective date: 29 October 2026. These Terms govern your use of the PenBot PHP2Shell Check, operated by Nikivox t/a Swarm Digital PTY ("Swarm Digital", "we", "us"), operating PenBot at penbot.ai. Our Privacy Policy is incorporated by reference and linked from the site footer.

1. Agreement

By running a check you agree to these Terms, to the Acceptable Use rules summarized in section 9, and to our Privacy Policy.

2. Eligibility

You must be at least 18 years old. There are no accounts: the check runs from the site address you submit, and you are responsible for every check you start.

3. Authorization warranty (important)

For the site you submit, you represent and warrant that:

You own or control the site, or you have explicit written permission from its owner to test it.
Your hosting provider permits security scanning of the site.

You must complete ownership verification (a small file on your site, a meta tag on your site root, or a DNS TXT record on your domain) before the check runs. The check is refused without it: there are no exceptions. You indemnify us against claims arising from a false authorization warranty.

4. Service scope

The PHP2Shell Check performs a point-in-time, outside-in check of one submitted site for the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The probe makes a small number of read-only requests to public pages and headers, the way any visitor would: it installs no agent, asks for no credentials, and never exploits anything. The verdict (Vulnerable, Safe, or Unknown) reflects the state of the site at check time. It is informational: not a security certification, not an audit, and not a guarantee that the site is secure or free of vulnerabilities.

5. Payments and the free-for-2026 pause

While the payment gateway is paused, the $9 fee is waived for 2026: no payment is taken, and the receipt states that nothing was charged. When payments resume, the check costs $9, payable through our payment gateway's hosted checkout. We never see or store card details. Applicable taxes are handled per gateway rules. When payments are active, checks that fail, that cannot verify the site, or that end in an Unknown verdict because the server hides its PHP version are refunded automatically.

6. Reports and data

Your report is a single page with the verdict, what we tested, and exactly what to change, available as a web report, a PDF, and a single-file HTML, plus a shareable badge. The report link carries a long random token: treat it as private, because anyone holding the link can view the report. You can ask us to delete a check, its report, and its artifacts at any time: [email protected].

7. Limitation of liability

To the maximum extent permitted by law, our aggregate liability for any claim is limited to the fees you paid for the affected check. We are not liable for indirect or consequential damages, lost profits, or data loss.

8. Indemnity

You will indemnify us against third-party claims arising from your use of the service in breach of these Terms or the Acceptable Use rules.

9. Acceptable use

The check exists for authorized security testing of your own assets. You may use it only for sites you own or control, or for which you hold explicit written permission from the owner.

Every site must pass the ownership verification gate before the check runs. Attempts to bypass verification are treated as abuse.

You must not:

Check, probe, or attack systems you are not authorized to test
Use the service as a load testing, denial of service, or harassment tool
Reverse engineer, scrape, or disrupt the PenBot service itself
Use the service for any unlawful purpose

Some hosting providers restrict or prohibit security scanning of systems on their infrastructure. You confirm that your hosting provider permits the check. We log a consent receipt for every check (verification method, policy version, timestamp, source IP), may refuse or suspend any check, and may disclose information where required by law or to prevent misuse. Report suspected misuse to [email protected]; we aim to respond within 24 hours.

10. Availability

We provide the service on a best-effort basis. We may perform maintenance and may change the service and its features.

11. Changes to these Terms

We may update these Terms. Material changes are notified on the site. Continued use after the effective date means acceptance.

12. Governing law

These Terms are governed by the laws of the Republic of South Africa. Subject to mandatory consumer protections, disputes fall under the exclusive jurisdiction of South African courts.

13. Contact

Nikivox t/a Swarm Digital PTY. Support: [email protected]. Abuse: [email protected]. Privacy: [email protected].