Skip to main content
STACKSHIELD
AboutTermsPrivacyCookiesAccessibilityContact

Last updated: October 30, 2026

Terms of Service

These Terms of Service ("Terms") are an agreement between you and Santa Singh Sehra, an individual operator based in Kenya ("StackShield," "we," "us," or "our"). They govern your use of stackshield.org and the StackShield security scanning and remediation service (the "Service"). By creating an account — which requires accepting these Terms, accepting our Privacy Policy, and confirming that you are at least 18 — or by connecting a Supabase, GitHub, or Vercel account, you agree to them. If you do not agree, please do not use the Service.

The short version

  • StackShield is beta software. It may contain bugs, change without notice, or be discontinued. There is no uptime guarantee.
  • Nothing changes in your accounts without your approval — except low-risk fixes you explicitly opt into auto-merging.
  • AI output can be wrong. You review every proposed fix before it is applied, and you are responsible for that review.
  • Paid plans renew monthly until you cancel. You can cancel at any time from Billing.
  • You own your code and data. We process them only to deliver the scans and fixes you ask for. We do not sell your data.
  • We limit our liability and the Service is provided "as is." No security tool can promise complete protection.

The rest of this page explains these points in full. Where a summary above and a detailed section disagree, the detailed section applies.

1. Beta status

StackShield is currently in a limited beta, capped at 100 accounts. The Service is offered for evaluation and:

  • May contain bugs, incomplete features, or behavior that changes without notice.
  • Has no guaranteed uptime and no service-level agreement (SLA).
  • May be modified, suspended, or discontinued at any time during the beta.
  • May be closed to new signups once the beta cohort is full.

We will make reasonable efforts to notify active beta users by email or in-app notice before changes that materially affect their access to the Service or their data.

2. Who can use the Service

You must be at least 18 years old and legally able to enter into a binding contract to create an account or use the Service. You confirm your age when you sign up, and we do not collect your date of birth. Accounts must be created and used by an individual — automated registration is not permitted. The Service is not directed to children, and if we learn that an account belongs to someone under 18, we will close it. You may not use the Service if you are barred from receiving it under the laws that apply to you.

3. What the Service does — and does not do

StackShield connects to the Supabase, GitHub, and/or Vercel accounts you choose to authorize and looks for common misconfigurations — including exposed keys, disabled Row Level Security, and open CORS policies — then proposes fixes for what it finds. Depending on your plan and settings, the Service can also run scheduled rescans (daily or weekly, at a time you choose) and alert you by Telegram when new issues appear, generate a shareable security badge, produce remediation receipts, and expose the StackShield MCP server so AI tools such as Claude Code or Cursor can run scans as you using a revocable API key.

The Service is one layer of defense, not a guarantee. It does not perform a full security audit, it does not detect every vulnerability class, and it is not a substitute for code review, penetration testing, or professional security advice. Findings reflect the configuration and code visible to the Service at the time of a scan and may become outdated the moment your project changes.

4. Accounts and connected services

You are responsible for keeping your StackShield login credentials secure, for all activity under your account, and for the accuracy of the information you give us. By connecting a third-party account, you grant StackShield permission to access it through the OAuth tokens you approve, solely to perform the scans and fixes you request. You confirm that you own the accounts and projects you connect or that you have the owner's permission to connect them.

You may revoke our access at any time from your StackShield settings or directly within the connected service. Revoking access disables the related functionality. Your use of Supabase, GitHub, Vercel, Telegram, and any AI provider remains governed by their own terms, and you are responsible for complying with them.

5. Fixes require your approval

StackShield does not change your connected Supabase, GitHub, or Vercel accounts without your explicit confirmation of the exact proposed change — with one exception: if you turn on "auto-merge low-risk fixes," approved low-risk pull requests may be merged automatically. Fixes marked "needs-review" always wait for your explicit approval, even when auto-merge is enabled. An unapproved change reaching your account would be a product bug, not intended behavior — please report it to contact@stackshield.org immediately.

6. Your responsibilities

You are responsible for:

  • Reviewing the exact change shown before confirming it.
  • Testing fixes in a non-production or staging environment first, where practical, and verifying that they work for your application.
  • Keeping your own backups so that a failed or incorrect change is recoverable.
  • Having the legal authority to connect and scan the accounts and projects you authorize.
  • Complying with the terms of Supabase, GitHub, Vercel, Telegram, and any AI provider you connect.

7. Bring your own AI provider key (BYOK)

AI-assisted fix analysis runs on an AI provider account that you connect and pay for separately (currently Ollama Cloud). Your key is encrypted at rest and used only to serve your own requests. You are responsible for your AI provider costs, usage limits, and compliance with that provider's terms. StackShield does not include AI usage costs in any plan, does not mark up AI usage, and is not responsible for charges incurred on your connected key. Your plan's monthly AI fix allowance (for example, 20 fixes per month on Starter and 200 on Pro) is described on our pricing page.

8. AI-generated output

Scan findings, proposed fixes, and remediation suggestions are generated by third-party AI models under your own BYOK credentials. We design our prompts and validation logic to produce accurate, safe output, but AI-generated content may be incomplete, inaccurate, or contain unintended side effects. We do not guarantee the correctness, completeness, or safety of any AI-generated output and are not liable for harm caused by applying such output without your own verification.

9. Plans, prices, and automatic renewal

The plans, prices, and included features currently offered are those shown on our pricing page, and the price displayed when you subscribe is the price that applies to you. Prices are in US Dollars and exclude any taxes that may apply; applicable taxes are calculated at checkout based on your billing location.

Paid plans are billed through our payment processor, Polar, which acts as merchant of record and handles payment collection, invoicing, and sales tax. Paid subscriptions renew automatically at the start of each monthly billing period until you cancel, and the renewal amount is shown next to the subscribe button before you commit.

10. Cancellation

You may cancel at any time from Billing in your account. Cancellation takes effect at the end of the current billing period: you keep access until then, and no further charges are made. Deleting your account also cancels any active subscription automatically (see Section 5 of our Privacy Policy). We do not require an email or phone request to cancel, and you do not have to give a reason.

11. Refunds

Payments already made are generally non-refundable, and we do not pro-rate unused time when you cancel mid-cycle. Exceptional cases — for example, a charge caused by a billing error on our side — are reviewed individually when you contact us within 30 days of the charge. Our full cancellation and refund policy, including the EU/UK 14-day right of withdrawal and how it applies to immediate access to a digital service, is set out on our Refund Policy page. Nothing in these Terms limits a refund or withdrawal right you have under mandatory consumer law.

12. Plan changes, failed payments, and price changes

Upgrades take effect immediately: Polar credits the unused portion of your current plan and charges the prorated difference for the rest of the current billing period to the payment method on file when you confirm the change. You are shown the amount before that charge is made, and your next renewal is at the new plan's full price. Downgrades also take effect immediately, and the unused portion of the higher plan is credited toward future invoices rather than refunded. If your payment method cannot be charged for a plan change or renewal, we may retry the charge, suspend paid features, or move the account back to the Free plan; access granted while a payment is pending does not waive the payment obligation.

We may change plan prices. For existing subscribers we will give notice by email or in-app before a new price takes effect, and the new price applies from your next renewal after that notice. If you do not want to continue at the new price, you may cancel before the renewal date as described in Section 10. Beta pricing and any "founding user" terms are honored as stated at signup unless we notify you otherwise in advance.

13. Acceptable use

You agree not to:

  • Connect, scan, or fix any account, project, or system you are not authorized to access.
  • Use the Service to gain unauthorized access to any system, or in a way that breaks the law or a third party's rights.
  • Circumvent usage limits, rate limits, the beta signup cap, or the bot-protection checks on our signup and scanning surfaces.
  • Resell, sublicense, or provide the Service to others as your own product, or use it to attack, overload, or probe systems you do not own.
  • Upload or transmit malware, or attempt to compromise the integrity or security of the Service itself.
  • Abuse our staff, use our notification channels (including Telegram) to send spam, or use the Service for any purpose other than securing projects you are responsible for.

We may suspend or terminate accounts that violate this section. Where practical, we will tell you why.

14. Your content and our intellectual property

You keep everything you bring. Your code, configuration, project data, and connected-account data remain yours. You grant us a limited, non-exclusive license to access, process, and display that material only as needed to operate the Service for you — running the scans and fixes you request — and as described in our Privacy Policy. That license ends when your data is deleted.

We keep what we build. The Service, including its software, design, prompts, detection rules, and the StackShield name and marks, belongs to us and our licensors. These Terms do not grant you any ownership of, or right to copy, resell, or reuse, the Service or its components. You may not use our marks for promotional purposes without written permission.

Feedback is welcome and non-confidential. If you send us suggestions, we may use them to improve the Service without obligation or compensation to you.

15. Availability, changes, and no warranty

We may add, change, or remove features during the beta, and we may suspend the Service for maintenance or because of an incident. The Service is provided "as is" and "as available," without warranty of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that all vulnerabilities will be detected, that every proposed fix will be correct, complete, or free of side effects, or that the Service will be uninterrupted, secure, or error-free.

16. Limitation of liability

To the maximum extent permitted by law:

  • StackShield and its operator are not liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost revenue, lost data, downtime, or security incidents, arising from your use of the Service.
  • Our total liability for all claims relating to the Service is limited to the greater of (a) the amount you paid us in the 12 months before the claim or (b) USD $100. This cap does not apply where a change we applied to your account without your review and approval caused the harm.
  • Nothing in these Terms limits liability that cannot lawfully be limited, and nothing here reduces your mandatory consumer rights.

17. Indemnification

You agree to indemnify and hold StackShield harmless from third-party claims, damages, and reasonable expenses arising from: (a) your misuse of the Service, (b) your breach of these Terms, or (c) your connecting or scanning accounts and projects you were not authorized to connect.

18. Termination

You may stop using the Service and delete your account at any time. We may suspend or terminate an account that violates these Terms, abuses the Service, attempts to compromise its integrity, or where we are required to do so by law. On termination, your right to use the Service ends, and we delete your data as described in our Privacy Policy. Sections 8 (AI-generated output), 14 (content and intellectual property), 15 (no warranty), 16 (limitation of liability), 17 (indemnification), and 20 (governing law) survive termination.

19. Changes to these Terms

We may update these Terms as the beta evolves. We will update the "Last updated" date above, and for material changes we will notify active users by email or in-app notice before the changes take effect. Continuing to use the Service after a change takes effect means you accept the updated Terms. If you do not accept them, you may cancel and stop using the Service.

20. Governing law and disputes

These Terms are governed by the laws of the Republic of Kenya, without regard to conflict-of-law principles, and mandatory consumer protections in your country of residence still apply to you. Before starting formal proceedings, please contact us at contact@stackshield.org so we can try to resolve the issue informally. If we cannot, disputes are subject to the exclusive jurisdiction of the courts of Nairobi, Kenya.

21. General

  • Severability: if any provision is found unenforceable, the rest remain in effect.
  • No waiver: if we do not enforce a provision, we do not give up the right to enforce it later.
  • Entire agreement: these Terms, together with our Privacy Policy, Refund Policy, and Cookie Policy, are the entire agreement between you and StackShield about the Service.
  • Assignment: you may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets, and we will notify you if that happens.
  • Force majeure: we are not liable for delay or failure caused by events beyond our reasonable control.

22. Contact

Questions about these Terms: contact@stackshield.org