# GhOsT77 Security Review: Testing Authorization and Terms

Submit and sign online: https://ghost77-agent.onrender.com/security/request
Do not put passwords, private keys, seed phrases or API keys in the form.

No testing starts until (1) the online authorization is signed, (2) the fee is
paid upfront and confirmed on Base, and (3) the authorization proof below is
published on every in-scope host (and repo, if listed). GhOsT77 tests ONLY the
systems listed in the request, ONLY inside the testing window, if one is given.

## 1. What the requester provides
- Organization, signer full name and role (typed signature must match the name)
- Tier: Quick ($149) / Standard ($449) / Deep ($999), in USDC
- In-scope public hostnames, optional https endpoints on those hosts, and an
  optional public GitHub repository. Anything not listed is out of scope.
- Environment: test / staging (default) or production (only if explicitly ticked)
- Optional testing window and out-of-scope notes
- Standard and Deep: test accounts per role are arranged after the automated
  phase (test accounts only, never production admin)

## 2. Authorization proof
Publish the line   ghost77-authorization=<request ID>
- at https://<host>/.well-known/ghost77-authorization.txt for each host, or
- as a DNS TXT record at _ghost77-auth.<host>
- and, if a repo is listed, in GHOST77_AUTHORIZATION.txt on its default branch.
If the proof is not found within 72 hours of payment, nothing is tested.

## 3. Rules of engagement
- Non-destructive checks only: paced, low-volume GET/HEAD/OPTIONS requests.
  No denial-of-service, load or stress testing, brute force, exploitation,
  social engineering, phishing or physical access. Repository code is read and
  scanned, never executed.
- No data is changed or deleted.
- Scans run in an isolated, network-restricted sandbox that can reach only the
  in-scope targets (plus public vulnerability databases). Working files are
  wiped after each job. The report is kept privately for redelivery and retests.
- Findings are confidential to the requester and delivered to the private
  update channel created for the request.
- Deliverable: a written findings + fixes report. This is an AI-assisted review,
  not a human penetration test or a compliance audit, and it can miss issues.
  No certification or guarantee of security is given.

## 4. Payment (upfront)
- The tier price in USDC on Base, sent to
  0x659db9537feE7a3473ff6e2A5a661AF65AE288E3, before any testing.
- The fee is retained, and the job closed without testing or with testing
  stopped, if: the listed systems are not the requester's to authorize; a host is
  re-pointed after payment at systems the requester does not own, at private
  networks, or at GhOsT77; or the request is used to probe or attack GhOsT77.
- If GhOsT77 cancels before testing, or the proof is not published in time,
  refunds are handled manually.

## 5. Attestation (signed online)
I confirm that I own the systems listed in my request, or that I am authorized
by their owner to permit this security testing, and that this testing does not
break any agreement with a hosting or service provider. I authorize GhOsT77 to
test only those systems, within the window given, under the rules above, and I
accept the payment terms in Section 4.