Website Security Sweep Implementation Notes
Purpose and status
This package provides an original agreement for the free website security sweep advertised through lmvdz.dev, a per-engagement authorization record, and a separately accepted hosting and patching offer. It has been revised against the website copy supplied by the user and the user's selected US $100 liability cap. The provider is Inkwell Finance, Inc., 3991 Holland Avenue, Dallas, Texas 75219, with contact email lmvdzande@inkwell.finance.
The CompleteTech reference was reviewed for context. The live lmvdz.dev pages could not be retrieved in this environment. The supplied page text is the source for the current offer and request-data policy; the deployed form, scanner, Cloudflare configuration, and actual record handling have not been audited. No live site has been changed.
The Word file is the editable agreement. The HTML contains the same full terms and schedules for integration into the website. It is a static document, not a working request form or scanner. These notes are internal operating and integration guidance, not part of the customer agreement.
A Texas attorney should review the agreement before customers are asked to accept it, particularly the ordinary-negligence cap and its presentation, the actual authorization process, consumer rights, and venue. The contract is a draft, not an opinion that every provision is enforceable.
Decisions reflected in this revision
- Provider: Inkwell Finance, Inc., offering website-security services through lmvdz.dev. No state of incorporation or registered assumed-name status has been invented.
- Free service: one external website security sweep, with no purchase, payment card, subscription, or hosting obligation.
- Intake: form submission permits follow-up and request processing. It does not authorize testing or form the sweep engagement.
- Acceptance: the client accepts the exact terms and completed scope in a signed record, affirmative written email confirmation, or deliberate final web confirmation. Provider acceptance and authority verification are also required before testing.
- Scope: selected public software-version, HTTPS/TLS/header, public administrative entry-point, directory-listing, and limited exposed-file checks. No exploitation, authentication attempts, or deliberate changes.
- Report: risk-prioritized observations, limitations, and a practical patching plan.
- Cap: US $100 aggregate for the free sweep and report, subject to the stated exceptions. This is the user's business selection, not a Texas statutory safe harbor.
- Promotion: agreed patches at no extra charge for the agreed work with 12 months of paid hosting. Hosting price, included work, charges, and commitment must be disclosed before acceptance. Migration, rebuilding, incident response, or unlimited repairs are not automatically included.
- Request data: Cloudflare application request records older than 90 days are removed when new requests are processed. This is not a guarantee that deletion occurs on day 90.
- Later records: accepted authorization, scope, correspondence, reports, and minimal redacted evidence may be retained separately for the stated service, authorization, dispute, and legal purposes. A more specific period can be agreed in Schedule A. The earlier draft's unconfirmed 30-day log, 12-month report, four-year authority, and 90-day backup promises have been removed.
- Marketing: this request does not subscribe the requester to marketing, and request information is not used for advertising.
Service commitments to implement
The draft retains a maximum authorization window of 30 calendar days after final scope confirmation, ending earlier when the report is delivered, the agreed end time arrives, or permission is withdrawn. This is a proposed contractual limit, not a claim about the deployed scanner.
The report target is five business days after the later of the scheduled start and completion of verification and final confirmation, unless Schedule A gives a different agreed date. This is a delivery estimate rather than emergency-response service.
The email lmvdzande@inkwell.finance and any additional agreed stop channel must be monitored while testing runs. Honor a clear withdrawal actually received through any other channel as well. No provider telephone number has been invented or made mandatory.
The confidentiality, safeguards, no-training, prompt redaction, and secure-report-delivery commitments require matching practices and service-provider arrangements. Configure those practices before accepting an engagement. Do not use a tool that publishes private findings or retains them for unrelated model training contrary to the agreement.
Required page integration
Use /services/website-security/scope/ as the agreement address if retaining the current route. Publish the new version as a distinct version; preserve any previously accepted copy. Existing requests must receive and accept the new agreement and exact scope before testing. Do not treat an older form submission as acceptance of the new US $100 cap.
Replace ambiguous provider wording in the professional-experience or service disclosure area with:
"Website security services are provided by Inkwell Finance, Inc. through lmvdz.dev. IBM is not a provider, sponsor, or endorser of this offer."
Add a service-provider disclosure near the footer or agreement link. The existing copyright credit does not by itself identify the contracting entity; copyright ownership is a separate question.
Keep the public offer's promise of agreed patches at no extra charge with 12 months of paid hosting. Show the hosting price, total minimum charge, renewal/cancellation terms, and exact patching scope in the separate written order before the customer commits. Do not insert an arbitrary promotion deadline copied from the reference site.
Request form copy
Use one required, initially unchecked acknowledgement next to a clearly labeled link. Preserve the existing Name, Company (optional), Email, Website, and optional notes fields. Collect the client's legal identity, website owner, and representative authority before final authorization; the optional company field alone does not establish those facts.
Checkbox label
"I am at least 18 and own this website or am authorized by its owner to request a sweep. I have read the sweep scope and data-use notice. I understand that this request permits follow-up only and that testing requires a separate written agreement and scope confirmation."
Link label
"Read the sweep scope, data use, and agreement"
Button
"Request a free sweep"
Text next to the button
"No payment or hosting agreement is created by this request. Inkwell Finance, Inc. will contact you to confirm your authority, the exact scope, and scheduling before testing. Please do not include passwords, access tokens, or sensitive files."
Do not add a marketing subscription checkbox as part of this revision. The supplied policy promises that this form does not subscribe people to marketing.
Replacement Scope and data use summary
"Inkwell Finance, Inc. provides this service through lmvdz.dev. We use your contact details, website address, and notes to handle your request, confirm authority and scope, arrange the sweep, and deliver findings. Request-form records are stored in our Cloudflare application request store. When new requests are processed, records more than 90 days old are removed. Because cleanup runs when new requests are processed, a record may remain longer than 90 days when no new request triggers cleanup.
"Submitting this form permits us to contact you; it does not authorize testing. Before a sweep begins, we confirm your authority, exact targets, permitted checks, limits, and schedule in writing. You must then accept the Website Security Sweep Authorization and Terms, version 2026-10-22-r2, and the completed scope. We do not test third-party infrastructure without the necessary permission.
"If a sweep proceeds, accepted terms, authority and scope records, service correspondence, reports, and minimal redacted supporting evidence may be retained separately as described in section 10 of the agreement. The request-form cleanup does not delete those separate service records. We do not publish identifying findings without separate permission or use this form to subscribe you to marketing. Hosting and patching require a separate approved agreement.
"For questions, access or correction requests, or a request to delete personal information, email lmvdzande@inkwell.finance or reply to our scheduling email. Legal retention requirements may affect what can be deleted. Scope and agreement version: 2026-10-22-r2."
Final written authorization
Before asking for acceptance, provide the full agreement and completed Schedule A in a retainable form. Show the client and website owner; exact hostnames, schemes, ports, included and excluded paths; selected checks; request and concurrency limits; start/end with time zone; report recipient; stop channels; report target; any additional retention terms; and the unchanged agreement version.
Suggested affirmative confirmation text for a signed record, email reply, or final unchecked web checkbox
"I am authorized to bind the client identified in the attached or displayed Sweep Authorization Record. I confirm that its targets, checks, limits, and schedule are correct and that all required permissions have been obtained. I accept that record and the Website Security Sweep Authorization and Terms, version 2026-10-22-r2, including section 12 and its US $100 aggregate liability cap, and authorize Inkwell Finance, Inc. to perform that sweep. I agree to electronic records and signatures for this engagement."
If implemented as a web flow, use the button "Confirm scope and authorize sweep". If implemented by email, preserve the affirmative reply with the exact documents and scope it accepts. An email link can display the record, but opening the link or an email-security system prefetching it must not initiate testing.
Provider must verify authority and record its own acceptance before the work becomes runnable. A confirmed email address alone is not evidence that the sender can authorize testing of the website or its hosting infrastructure.
Records and implementation behavior
Preserve the final written authorization, exact terms/version or content digest, normalized scope as displayed, client identity, representative role, owner/delegation evidence, authority-verification result, provider acceptance, confirmation timestamps, and later changes or withdrawals. Store that evidence outside the transient form-request records before those records become eligible for cleanup. This is an operational requirement, not an assertion that a separate archive already exists.
Collect only necessary evidence. An IP address or user-agent can support an audit record if disclosed and appropriately retained; it is not proof of identity or ownership. Use consistent server timestamps and show scheduling in an explicit zone such as America/Chicago.
The scanner or reviewer must enforce the exact approved hostname, scheme, port, path, check categories, time window, and operating limits. Evaluate every redirect against the same full scope. Do not silently add www, origin IPs, another subdomain, or a neighboring tenant. Validate target URLs and resolution so user-supplied targets cannot direct the system into loopback, private, link-local, or cloud metadata addresses.
Enforce request-rate, concurrency, and total-volume budgets across all workers and sources, including retries and permitted redirects. Count concurrent HTTP requests as well as connections; HTTP/2 can carry multiple requests on one connection. Do not enable a scanner's broad default template set if it performs exploits, logins, state changes, or unapproved path checks.
Administrative or login entry-point checks mean observing the approved public entry pages. Do not enter credentials, invoke administrative operations, or bypass access controls. Directory listings and exposed-file checks must use the approved limited path set. Do not deliberately retrieve full backups, databases, or credential collections.
Bound responses and avoid retaining raw bodies unnecessarily. Stop affected checks if sensitive content or apparent compromise appears, notify the verified client, and promptly redact or remove incidental sensitive captures. Keep only minimum redacted evidence. Incident response and malware removal require a separate scope and access authorization.
Report each selected category honestly as completed, skipped, or inconclusive. Public software versions support preliminary exposure findings; they do not prove exploitability, compromise, or successful patching. Use current vendor advisories for technical comparisons instead of hard-coding a particular vulnerability campaign into the contract. Version suppression, backports, modified builds, configuration, and intermediaries can limit the conclusion.
Deliver findings to a verified recipient using an appropriate secure channel. Monitor stop channels during the testing window, cancel queued work upon withdrawal, and preserve the stop receipt and action times. Publish and implement any specific retention periods added to Schedule A; do not substitute a contractual promise for a working deletion process.
Primary legal sources used in drafting
Texas Penal Code Chapter 33, effective consent and unauthorized computer access
https://tcss.legis.texas.gov/resources/PE/htm/PE.33.htm
Texas Business and Commerce Code Chapter 322, electronic agreement, attribution, and retention
https://tcss.legis.texas.gov/resources/BC/htm/BC.322.htm
Texas Business and Commerce Code Chapter 17, including DTPA waiver restrictions
https://tcss.legis.texas.gov/resources/BC/htm/BC.17.htm
Texas Civil Practice and Remedies Code Chapter 15, venue
https://tcss.legis.texas.gov/resources/CP/htm/CP.15.htm
Texas Business and Commerce Code Chapter 521, information safeguards and breach notification
https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm
Texas Occupations Code section 1702.104, including the cybersecurity-analysis provision
https://tcss.legis.texas.gov/resources/oc/htm/oc.1702.htm
Bombardier Aerospace Corp v SPEP Aircraft Holdings, Texas Supreme Court, 2019
https://www.txcourts.gov/media/1443450/170578.pdf
18 USC 1030, official GPO 2024 compilation
https://www.govinfo.gov/content/pkg/USCODE-2024-title18/html/USCODE-2024-title18-partI-chap47-sec1030.htm