Terms of Service

These Terms of Service (“Terms”) are a binding agreement between you and All Still Good, operated by Eastbase Studio (“All Still Good”, “we”, “us”). By creating an account or using the service, you agree to these Terms. If you do not agree, do not use All Still Good.

All Still Good is a continuous health and security monitoring service for web applications — particularly apps built with AI tools such as Lovable, Bolt, Cursor, Replit and v0. It runs read-only checks against an app you have verified you own, holds a known-good baseline, compares each later scan against that baseline, and notifies you in plain English when something appears to break, leak, or regress. It can also generate suggested fix briefs to help you remediate findings.

All Still Good detects and explains issues. It does not modify, patch, or otherwise change your application — remediation is always in your hands.

You must provide accurate information when you register and keep your credentials secure. You are responsible for all activity under your account. You must be at least 18 years old (or the age of majority where you live) to use All Still Good.

This is a core condition of using All Still Good, not a formality:

• You may only add and monitor an application that you own or are otherwise expressly authorized to test.
• Before any scan runs, you must verify ownership of the target by publishing a token we give you — as a DNS TXT record, a meta tag on the page, or a file at a /.well-known/ path on the domain. Nothing is scanned until this gate passes.
• By verifying a target and running a scan, you confirm you have authority to authorize automated read-only security checks against it.
• You must not use All Still Good against any system you do not own or are not authorized to test. Doing so may be unlawful and is a material breach of these Terms.

You are solely responsible for ensuring you have the right to monitor every target you add. We may suspend or terminate accounts we reasonably believe are scanning systems without authorization.

Two connections are optional. Monitoring works without either, and you can add or remove them at any time.

• GitHub — ownership verification does not use GitHub; it is always the DNS, meta-tag, or well-known-file check in Section 4. GitHub is separate: signing in with GitHub is one way to authenticate, and if you additionally connect a repository we use your GitHub authorization to read that repository's package manifest so we can check your dependencies against public vulnerability data. We read; we never write, commit, open pull requests, or change anything in your repository.
• Supabase — you may paste your project URL and your Supabase anon (public) key so we can check whether tables are readable without logging in, which is how row-level-security mistakes surface. The anon key is the key your app already ships to every visitor's browser. We store it encrypted, use it only for that read-only check, and you can remove it at any time.
• You must never give us a Supabase service_role key or any other privileged credential. We reject service_role keys at the validation layer, and supplying privileged credentials is a breach of these Terms.
• You are responsible for having the authority to connect any repository or project you add.

You agree not to:

• Use All Still Good to attack, overload, exploit, or gain unauthorized access to any system.
• Attempt to circumvent the ownership-verification gate or other safeguards.
• Reverse-engineer, resell, or build a competing service from the platform.
• Upload unlawful content, infringe others' rights, or interfere with the service's operation.
• Provide a Supabase service_role key or other privileged credential — we reject these by design and you must not attempt to supply them.

All Still Good offers a free tier (a one-time baseline scan) and paid subscriptions (Pro and Business) billed monthly. Paid subscriptions are processed by our Merchant of Record, Lemon Squeezy, which handles payment, invoicing, and applicable taxes. Subscriptions renew automatically until cancelled. You can cancel, upgrade, or downgrade at any time from your billing settings. Cancellation, proration, and refund terms are described in our Refunds & Cancellation Policy.

Eligible accounts may receive one 30-day promotional grant of Pro access. Promotional access requires no payment card or checkout, is not a paid subscription, and does not renew or create an automatic charge. Unless you voluntarily start a paid subscription, promotional access ends on the date shown in your billing settings and the account returns to Free; your app and scan history remain in the account. We may stop issuing new grants without ending a grant already issued, subject to these Terms and the acceptable use rules above.

All Still Good uses OpenAI GPT-5.6 models through Vercel AI Gateway to write plain-English explanations, suggested fix briefs, scan summaries, and observational journey steps.

AI-generated explanations and fix briefs are suggestions only. They must be reviewed by a human before you make any technical or security change to your application. Do not paste a fix brief into an AI coding tool, a terminal, or your codebase and apply it unread. AI output can be confidently wrong: it can misdiagnose a finding, miss context specific to your app, suggest a change that breaks working functionality, or propose something that weakens security rather than improving it.

• Read and understand a suggested change before applying it, and if you can't, ask someone who can.
• Test changes somewhere safe before production, and keep a way to roll back.
• Treat a fix brief as a starting point for a decision, never as an approved patch.
• If a finding involves anything you can't safely evaluate, get qualified human help rather than acting on the AI output alone.

These outputs are not professional security, legal, or engineering advice, and we make no warranty that they are accurate, complete, or suitable for your situation. You remain solely responsible for every change you make to your own app, including changes you make in reliance on AI output from All Still Good.

All Still Good performs best-effort, automated, read-only checks for a defined set of common issues. It is a monitoring aid, not a guarantee that your application is secure and not a substitute for a professional security audit, penetration test, or compliance assessment. We do not warrant that we will detect every vulnerability, that findings are free of false positives or false negatives, or that your app is safe because a scan came back clean. Security is ultimately your responsibility.

All Still Good and its software, design, and content are owned by Eastbase Studio and protected by intellectual-property laws. You retain ownership of your data and your applications. You grant us the limited rights needed to operate the service for you (for example, to scan your verified targets and store findings).

All Still Good relies on third-party providers (including hosting, database, payment, email, AI, and analytics providers) to operate. Your use of the service is also subject to those providers’ terms where applicable. We are not responsible for third-party services we do not control. See our Privacy Policy for the providers we use.

You may stop using All Still Good and delete your account at any time. We may suspend or terminate your access if you breach these Terms, particularly the authorized-monitoring condition in Section 4. On termination, your right to use the service ends; sections that by their nature should survive (e.g. disclaimers and limitation of liability) will survive.

The service is provided “as is” and “as available”, without warranties of any kind, to the maximum extent permitted by law. To the fullest extent permitted by law, All Still Good and Eastbase Studio will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss arising from a security incident we did not detect. Our total liability for any claim relating to the service is limited to the amount you paid us in the twelve months before the claim.

We may update these Terms as the product evolves. If we make material changes, we will update the “last updated” date and, where appropriate, notify you. Continuing to use All Still Good after changes take effect means you accept the updated Terms.

These Terms are governed by the laws of the Socialist Republic of Vietnam, where Eastbase Studio operates, without regard to conflict-of-law rules.

If something goes wrong, email support@allstillgood.com first — we would much rather sort it out directly, and most issues are a billing or account question. If a dispute cannot be resolved that way, it will be brought before the competent courts of Vietnam, and you and we submit to their jurisdiction. There is no mandatory arbitration and no class-action waiver in these Terms.

If you use All Still Good as a consumer, nothing above removes the protection of mandatory consumer-law rules of the country you live in, or a right you have under those rules to bring a claim in your local courts.

Questions about these Terms? Email support@allstillgood.com.