1) Scope; What a Passive Audit Reads

This policy covers the audits Metrolux Solutions Inc. ("Metrolux," "we," "us") carries out on websites it does not operate, and the reports it publishes from them.

A passive audit reads only what a site already serves to anyone. That is the TLS certificate and security headers a browser receives, the DNS and mail authentication records any resolver returns, the software versions a page discloses, and the page content itself: the same information a visitor, a search engine or an attacker sees first.

We do not probe, scan or attempt to access anything. The line sits there because everything on this side of it is already public.

2) The Owner Sees the Findings First

The owner of the audited site receives the findings before anything is published. A finding is worth more to the business that can fix it than to anyone reading about it.

3) Thirty Days to Fix

Publication waits 30 days from the day the owner receives the findings. Much of what these audits find is an expired certificate, a missing mail record or a broken link, each a few hours of work, so 30 days is enough time.

4) What a Published Report Contains

Every report is redacted before it is published:

  • Removed: credentials, personal data, exploit detail, and any pricing or proposal made to the owner.
  • Kept: what is wrong, the evidence for it, and what fixes it.

A finding describes the weakness and the remedy. It never includes a working method of attack.

5) Withholding or Taking Down a Report

Any owner can ask us not to publish a report, or to take down one already published, by writing to [email protected]. We honour the request.

What a takedown cannot do. It removes the report from our sites. It cannot recall a copy that a search engine or another person has already made.

6) Who Leads the Audits

Rodrigo Landa, President of Metrolux Solutions Inc., leads every audit we carry out. Questions about an audit or a report go to [email protected].

This policy is written for the owners of the sites we audit, and for anyone deciding how far to rely on what we publish.