Legal — Redifact

Who we are

Redifact Pty Ltd conducts this work. Assessments are done remotely by Ashton Vaughan. There is no public street address and no walk-in office.

This website

This site describes one product. The pages are information. They are not an offer, not a quote, and not authorisation to test anything.

The product

The product is an authorised, non-destructive assessment of named public-facing websites, applications, APIs, and internet-facing infrastructure. Only systems named in a signed scope are tested. Nothing is tested before both parties sign the scope, the rules, and a maximum invoice. Out-of-scope systems are not tested.

Who may enquire

Enquire only for systems you are authorised to have assessed. Do not name other people’s assets as if they were yours. An enquiry is not authorisation. Submitting the contact form does not start a test.

Fees

Default fees are in USD and bind only when signed: Info $0, Low $500, Medium $1,500, High $4,000, Critical $10,000. The cap is $15,000 per assessment. No qualifying finding, no fee.

These items are not charged:

Unverified scanner output
Version banners
Duplicate findings
Issues outside the signed scope
Best-practice notes with no attack path
Self-XSS
Missing headers without an attack path
Issues that need destructive tests to prove

Website content

The content of this website is provided as information. It carries no warranty. Pages may change.

Unauthorised testing

Do not use this site to solicit unauthorised testing. Redifact does not start work from a form submit or an email thread.

Findings, reports, and invoices

Findings, reports, and invoices exist only under a signed engagement. Until then there is no assessment, no report, and no invoice.

Governing law

These terms and the work are governed by the law of Queensland, Australia. Courts in Australia have jurisdiction.

Contact

Write to [email protected]. [email protected] and [email protected] are operational addresses for the same practice.

Last updated 20 August 2026.