01
Zero requests before consent
Testing starts only after you verify the URL is yours with a DNS record or file and sign the electronic consent form. Until then, not a single request goes to the target.
Because we send requests to other people's servers, we define what we send, when, and how far, and enforce it inside the product.
As of 2026-10-31
01During testing
Only to approved URLs, only as much as agreed
The eight rules below are enforced in server code, not in settings.
02
We stop as soon as the proof disappears
We re-verify ownership right before and during the test. If the verification value is removed, the test stops automatically.
03
Write tests are off by default
Requests that change data are sent only when you turn them on, and even then only on test URLs. Excluded URLs are never touched.
04
No more than 5 requests per second
The default cap is 5 requests per second. You can watch requests per second live on the progress screen.
05
Personal data in responses is masked before storage
Values like names, phone numbers, and addresses are masked before storage. Reports and raw requests keep only the masked values.
06
Test accounts are encrypted and deleted after 7 days
Test account passwords and tokens are stored encrypted with AES-256-GCM and deleted 7 days after the test ends.
07
We don't store passwords
You sign in with a one-time link sent by email. Our service has no passwords.
08
We keep request logs
We keep the original log of every request sent. It's proof that testing stayed within the agreed scope.
02Testing our own service
We run the same 6 tests on our own service
We run admin functions, unauthenticated writes, other users' data, privilege fields, file paths, and error exposure against our production URL gate.define404.com as is. We rerun them on every deploy.
6-category test on production
78 / 78
All 78 checks passed on 2026-10-31, including rate limit tests.
Security headers
7
Every response carries 7 headers, including HSTS, Content Security Policy, and framing protection.
Report unauthorized testing
If you received a test you didn't authorize, send us the URL and time. We'll stop it immediately and suspend the account.