Acceptable Use Policy

Last updated October 27, 2026. Operated by LeakOwl ("LeakOwl", "we", "us"). Questions: support@leakowl.com.

Draft policy text prepared for launch. It has not been reviewed by a lawyer; have it reviewed and fill in the company details before taking real payments.

LeakOwl exists to help owners find their own mistakes. You agree not to:

Scan, or attempt to scan, any site, domain or system you do not own and are not explicitly authorised in writing to test.
Place a LeakOwl verification file or DNS record on a system you do not control, or otherwise try to defeat, spoof or bypass ownership verification.
Point LeakOwl at internal, private, loopback, link-local or cloud-metadata addresses, or use redirects, DNS tricks or look-alike hostnames to make us contact a system other than the one you verified.
Use LeakOwl to launch denial-of-service traffic, to hammer a host, or to evade our rate limits (including by using multiple accounts or addresses).
Use scan results to access, copy, modify or sell another person's data, or to extort or threaten anyone.
Resell scan output as your own audit of third-party systems without their authorisation.
Reverse engineer, scrape or overload the service, or use it in violation of applicable law.

What we do about abuse

Every scan requires attestation and fresh technical proof of control, is limited to a request budget, and is logged. We refuse scans that fail these checks, rate-limit by network, account, app and target host, and may suspend accounts and report unlawful activity to the affected party or authorities.

Reporting

If you believe LeakOwl scanned a site without the owner's authority, or you are the owner of a site and want scans stopped, email us with the domain. We will investigate promptly and block the domain where appropriate.

Security researchers

This service only tests owner-verified sites. If you find a vulnerability in LeakOwl itself, please email us before disclosing it publicly.