Draft — legal review pending before launch
These terms are a draft and may change after legal review. The effective date is not set yet (drafted 2026-10-29). The Korean version prevails.
These terms set the conditions for using DicoGuard, a website security self-check service run by Dicolab ("the Company"), and the responsibilities of the Company and users.
Surface checks look at response headers, certificates, cookies, page content and DNS using the same public requests as a normal visitor, and show a score, severity and fixes. After a member verifies domain ownership by DNS TXT record or file, deep scans also check multiple pages and exposed files (.git, .env, backups) for that domain only. Results are provided on screen and as PDF. Features marked "coming soon" are not provided yet.
Before requesting a scan, users must agree that they only scan sites they run or are allowed to check, and that they are responsible for unauthorized scans.
The service is an automatic surface check of public information. It does not perform intrusive tests (SQL injection, XSS, etc.), does not replace a penetration test, and does not guarantee that a site is safe. The Company does not guarantee the accuracy or completeness of results.
Up to 5 scan requests per hour per IP; the same site within 10 minutes returns the previous result. Scanning sites without permission, automated excessive requests and malicious use of results are prohibited and may lead to restrictions.
In the Security Q&A board, the Company may hide or delete posts and answers that expose attack targets (server IPs, admin URLs, open ports, etc.), secrets or personal data, posts asking for attack methods or for diagnosing others' sites, and reported posts confirmed to break these rules.
Guest results are kept for 30 days and then deleted automatically. For members, detailed results (findings, evidence, request logs) are kept for one year after the scan and then deleted, while a one-line summary (domain, time, type, score, grade, counts by severity) is kept until you leave. Results can be viewed only by the browser that ran the scan and the member who requested it, so share reports with care. Members can delete their own results.
Site operators can remove their domain from scans on the opt-out page. After proving they run the domain with a value in a DNS TXT record or a check file, nobody can scan that domain or its subdomains with the service. To remove an opt-out, contact us below and we confirm again before removing it. Scan requests use the User-Agent "DicoGuard".
To the extent permitted by law, the Company is not liable for damage arising from the use of results, except in cases of intent or gross negligence.
Changes are announced 7 days before they take effect. These terms are governed by the laws of the Republic of Korea.