Program terms

Last updated October 21, 2026

These terms apply to every application to, and enrollment in, Strobes – Attacker’s First Look (SAFL), operated by Strobes Security (“Strobes”). By applying to participate, you agree to them on behalf of your organization.

1. 01

   Application of these terms

   These terms govern applications to, and participation in, the program. "Participant" means the organization that owns or operates the submitted domain. "Applicant" means the individual who submits the application on the Participant’s behalf.

2. 02

   Eligibility

   The Participant must own or operate the submitted domain. The Applicant must apply from a work email address on that domain or one of its subdomains, and must have authority to commit the Participant to these terms. Strobes may ask for additional evidence of ownership or authority before accepting an application.

3. 03

   Ownership verification

   Strobes sends a one-time code to the Applicant’s work email address. Entering the code shows control of that mailbox; it does not by itself authorize any testing. Personal and disposable email services cannot be used.

4. 04

   Agreed scope

   Before testing, a Strobes analyst confirms in writing the domains, subdomains and IP ranges that are in scope, along with any exclusions. Assets hosted or operated by third parties, and assets the Participant does not own, are outside scope.

   The Participant agrees to tell Strobes promptly if an in-scope asset is transferred, decommissioned or moved to a third-party provider.

5. 05

   Consent to research activity

   Once scope is confirmed, the Participant consents to Strobes performing discovery and security testing against the in-scope assets for the duration of the enrollment, using manual, automated and AI-assisted techniques directed by Strobes analysts.

6. 06

   Methods and limits

   Strobes does not perform volumetric or denial-of-service testing, social engineering or physical testing under the program, and does not intentionally modify or delete Participant data. Data accessed during testing is limited to what is needed to evidence a finding. Testing windows and constraints agreed with the Participant are observed.

7. 07

   Reports and communications

   Findings are sent only to the verified contact, by email from noreply@strobes.co. That address does not receive replies. Questions, remediation requests, retest requests and changes of contact are submitted through the follow-up form linked in each report.

8. 08

   Issues in third-party products

   If research identifies an issue that originates in a vendor’s product or service, Strobes may report it to that vendor through coordinated disclosure and will share with the vendor only the information needed to describe and resolve the issue. Where practical, Strobes informs the Participant before contacting the vendor.

9. 09

   Confidentiality

   Findings about the Participant are confidential. Strobes stores them with restricted access and does not publish them. Strobes may use aggregated observations that cannot identify the Participant to improve its research methods and products. Personal data is processed under the Strobes privacy policy.

10. 10

    No fees or purchase obligation

    There is no charge to participate, and participation does not require the Participant to buy any Strobes product or service. Strobes is a commercial company and operates the program alongside its paid offerings.

11. 11

    Program availability

    Analyst capacity is limited. Strobes may accept, prioritize or decline applications at its discretion and does not commit to any particular coverage, frequency, completeness or timing of research. The Participant remains responsible for remediating its own systems.

12. 12

    Warranties and liability

    Strobes conducts research with reasonable care, but the program and its findings are provided without warranties of any kind, to the extent permitted by applicable law. To the same extent, Strobes is not liable for indirect or consequential loss arising from participation, including any service impact resulting from testing performed within the agreed scope and limits.

13. 13

    Pausing, withdrawing and ending

    The Participant may pause research or withdraw from the program at any time through the follow-up form, and testing stops once the request is processed. Strobes may suspend or end an enrollment, or the program, at any time.

14. 14

    Changes to these terms

    Strobes may revise these terms and will show the date of the latest revision on this page. Continued participation after a revision takes effect constitutes acceptance of the revised terms.