LAST UPDATED 12 FEBRUARY 2026
A penetration test is a point-in-time assessment. It reflects what we were able to find, in the scope agreed, in the time allocated, against the version of your systems that existed during the test window. It is professional advice, not a certification, and it is not insurance.
Earthshaker Security does not and cannot guarantee that your systems are secure, or that you will not suffer a breach. No testing methodology finds every vulnerability. A clean report means we found nothing in scope, not that nothing exists. Any party representing otherwise — including us, in any sales conversation — is wrong, and this document overrides them.
We test only assets you own or are contractually entitled to authorize testing of, listed explicitly in a signed scope document, within an agreed window. Testing outside that scope does not happen. You are responsible for obtaining any permission required from your hosting provider, platform or third-party vendors, and for confirming that you have the authority to grant ours.
Exploitation stops at the minimum demonstration that a vulnerability exists. We do not destroy, modify or exfiltrate production data; we do not deploy persistent code; we do not pivot outside scope. Despite these controls, active testing carries inherent risk to availability. We recommend a recent, verified backup before any test window, and we test outside your peak hours where you ask us to.
Findings are yours to act on. Earthshaker Security is not responsible for losses arising from findings you were told about and chose not to remediate, or from changes made to your systems after the test window closed.
Reports, evidence and any data encountered during testing are treated as confidential, held encrypted, and destroyed at the end of the engagement plus the re-test period. We do not publish client names or findings without written permission. If we discover evidence that you are already compromised, we tell you immediately, in the way agreed in the scope document.
Our liability in connection with any engagement is limited to the fees paid for that engagement, except where liability cannot be limited by law. Full terms are in the service agreement signed before work begins; this page summarizes them and does not replace them.
Earthshaker SecurityWe find the cracks before they do. Automated and human-verified security testing for web applications.
earthshakersecurity.com · contact@earthshakersecurity.com
Earthshaker Security