Terms of Use and Sale

DualGuard is operated by ShawarmaSec, a société à responsabilité limitée with a sole shareholder and share capital of EUR 500, registered with the Paris Trade and Companies Register under number 989 917 026. Its registered office is located at 30 boulevard de Sébastopol, 75004 Paris, France. ShawarmaSec’s registered activities include blockchain code review, the operation of decentralised applications and the delivery of audit reports.

Contact email: info@dualguard.xyz. Privacy contact: privacy@dualguard.xyz.

These Terms are supplemented, where applicable, by the Privacy Policy, Cookie Policy, Contest Rules, Bug Bounty Rules, Rules of Conduct, Safe Harbour or disclosure rules, service order, quotation, statement of work and any specific programme page made available by DualGuard. A document applies only if it has been made available to the relevant user or client before the relevant programme or service begins.

If documents conflict, the signed statement of work or quotation prevails for the relevant paid services, and the specific programme rules prevail for the relevant contest or bounty. These Terms prevail for all other matters. The Privacy Policy governs personal data processing and prevails on privacy matters.

By creating an account, clicking an acceptance button, submitting a report, joining a programme, ordering a service or using the platform, you confirm that you have read and accepted these Terms and the documents incorporated into them.

If you accept these Terms for a company or other legal entity, you represent that you have authority to bind that entity. Electronic records, account logs, acceptance records, invoices and communications may be retained as evidence of the relationship and of the transactions made through the platform.

You must provide accurate, current and complete information and keep it updated. You are responsible for the confidentiality of your credentials and for activity carried out through your account, except to the extent that an unauthorised access is exclusively attributable to DualGuard.

DualGuard is intended for persons aged 15 or over. A person under 15 may participate only where the applicable programme rules expressly permit it, the required authorisation from a holder of parental responsibility has been obtained and applicable law permits it. Participation in paid programmes or roles involving contractual, reward or judging responsibilities may be subject to a higher minimum age stated in the applicable programme rules. DualGuard may restrict access based on legal, sanctions, tax, payment, compliance or technical requirements.

You must not create multiple accounts to evade a suspension, eligibility restriction or ranking rule.

DualGuard may provide security review contests that include a phase for automated tools, including AI agents and static analysers, and a phase for security guards who compete using the methods of their choice. A mitigation review may follow a security review contest where needed. DualGuard may also provide pre-launch bug bounty programmes and other security programmes in partnership with security firms offering complementary services, including Secure and Prove, Full-Stack Security and The Bridge. DualGuard also provides reporting tools, judging workflows, leaderboards and related platform services.

The precise scope, assets, repositories, environments, languages, exclusions, deliverables, prize pool, platform fees, payment terms and any applicable programme timetable are stated in the quotation, statement of work or programme rules. Any timetable is indicative unless expressly stated to be binding and may depend on the quality and volume of the code and materials provided, the number and severity of findings and the client’s cooperation.

DualGuard may use automated tools and AI-assisted systems to identify, classify, prioritise or assess submissions. Unless expressly agreed otherwise, automated results are assistive and do not constitute a guarantee that a system is secure or free from vulnerabilities.

A client order is formed when the client accepts a quotation or statement of work, signs electronically, pays an amount requested by DualGuard or otherwise clearly confirms the order in writing.

The quotation describes the essential characteristics of the services, the applicable pricing method, the client deliverables and any assumptions or exclusions. Any timetable stated in the quotation is indicative unless expressly stated otherwise and may be adjusted to reflect the quality and volume of the code and materials provided, the number and severity of findings and the client’s cooperation.

Prices are stated in the currency and tax basis shown in the quotation. They may include platform fees, mitigation review fees where applicable, and amounts reserved for rewards payable to guards, judges or triagers.

Service descriptions and pricing presented in marketing materials are subject to the applicable quotation and programme rules.

A client must fund the applicable prize pool or reward reserve and the agreed platform fees before the relevant programme begins. Unless otherwise agreed in writing, 25% of the platform fees is payable before the programme is scheduled and the remaining 75%, together with the prize pool or reward reserve, is payable before the programme starts. DualGuard may deduct its agreed fees and applicable costs before distributing rewards.

Invoices or payment requests are payable within the period stated in the quotation or invoice. Unless otherwise agreed in writing, the payment schedule is 25% of the platform fees before scheduling and the remaining 75%, together with the prize pool or reward reserve, before the relevant programme starts. For professional clients, late payment may result in statutory late-payment interest and the fixed statutory recovery indemnity, without prejudice to any additional amount recoverable under applicable law.

Stablecoin payments in USDC are the expected default. Other digital assets are accepted only where expressly authorised in the relevant quotation or programme rules. The payer is responsible for the selected network, destination address, amount, transaction fees and any loss caused by an incorrect transfer. DualGuard never requests a private key, seed phrase, wallet password or other secret enabling access to digital assets.

Each participant remains responsible for assessing and declaring any tax or social-security obligations applicable to rewards, fees or other payments, unless mandatory law provides otherwise.

The client warrants that it owns or controls the code, systems, data, marks and materials supplied to DualGuard or has obtained all permissions necessary for their use in the engagement.

The client must define the authorised scope of testing, the assets concerned, the exclusions, the permitted environments, the authorised contacts and any special safety rules. Passive review or limited observation of related assets may be carried out where reasonably necessary to understand the project as a whole, but active testing, exploitation, access to data or modification of any asset outside the authorised scope requires prior written authorisation. The client remains responsible for deployment, remediation, production decisions, appropriate backups and business continuity.

The client must not ask DualGuard or any participant to conduct unauthorised, destructive or unlawful testing, or to access data beyond what is necessary for the agreed security work.

A guard may test only assets expressly authorised by the relevant programme or engagement. Guards, judges and triagers must comply with the scope, timing, disclosure rules, reporting channel and conduct requirements applicable to that programme.

Unless expressly authorised, no guard, judge or triager may conduct destructive testing, modify or delete data, exfiltrate data, disrupt services, access personal data unnecessarily, publish findings prematurely or continue testing where material harm may result.

Guards must submit original, accurate and sufficiently detailed reports and must preserve only the minimum evidence necessary to demonstrate the issue and support remediation. Duplicate, invalid, speculative, automated or materially incomplete submissions may be rejected under the applicable programme rules.

A programme does not guarantee a reward. Rewards, rankings, severity classifications, duplicate treatment and appeals are determined under the applicable programme rules and the decisions of the authorised judges or review team.

Non-public programme information, including reports, source code, vulnerability information, communications, client information and judging materials, is confidential. It may be accessed only by persons who need the information for assessment, judging, remediation, mitigation, payment, dispute resolution, compliance or security operations.

No participant may publish or disclose a vulnerability, report, exploit, proof of concept or confidential information before the date authorised by DualGuard, the client or the relevant programme rules.

Where a client authorises publication, the publication terms may specify the content, audience, timing, attribution, anonymisation and period of availability.

DualGuard and ShawarmaSec retain all rights in the platform, software, interfaces, databases, methods, models, tools, documentation, trademarks and branding. Except as expressly stated, no intellectual property right is transferred to a user or client.

The client retains ownership of its code, data, systems and materials. It grants DualGuard the limited rights necessary to host, analyse, transmit, reproduce and otherwise use them to perform the agreed services.

A guard retains rights in original material included in a submission, subject to a worldwide, non-exclusive, royalty-free licence to DualGuard and the relevant client to review, reproduce, analyse, test, remediate, document, resolve disputes and operate the programme. Any publication or broader use requires the authorisation stated in the applicable programme rules.

Personal data is processed in accordance with the DualGuard Privacy Policy. Depending on the user’s role, DualGuard may process account details, professional profiles, contest data, reports, technical logs, payment information, tax information, wallet addresses and information required to prevent fraud and secure the platform.

DualGuard may act as controller for its own platform activities and as processor for certain client-provided information, as determined by the applicable agreement.

Users must not include personal data in security reports unless strictly necessary. Payment information and other personal data are not public by default.

DualGuard implements technical and organisational measures appropriate to the risks of the platform and the information processed. No platform, audit, contest or security review can guarantee absolute security, uninterrupted availability or the absence of vulnerabilities.

The platform may be unavailable because of maintenance, security incidents, infrastructure or provider failures, network congestion, changes to third-party services or events beyond DualGuard’s reasonable control.

DualGuard may suspend or restrict access where necessary to protect the platform, preserve confidentiality, investigate fraud or abuse, comply with law, address a security incident or respond to a breach of these Terms or programme rules.

Where reasonably possible, DualGuard will inform the affected user of the reason for the measure and its expected duration. A contract or account may be terminated for a serious or repeated breach, non-payment, unlawful use, unauthorised disclosure, security abuse or materially inaccurate information.

Confidentiality, payment, intellectual property, data protection, liability and dispute provisions survive termination to the extent necessary to give them effect.

ShawarmaSec is liable for direct damage caused by a proven breach of its contractual obligations, subject to mandatory applicable law.

ShawarmaSec is not liable for damage caused by inaccurate or incomplete information supplied by a user or client, unauthorised or out-of-scope testing, client deployment decisions, failure to remediate, third-party services, blockchain or network failures, loss of credentials or digital-asset secrets, or the user’s unlawful or non-compliant conduct.

For professional clients, and except in cases where limitation is prohibited by law, total liability for a service is capped at the amount excluding tax paid or payable for that service during the twelve months preceding the event giving rise to the claim. This cap does not apply to obligations that cannot legally be limited or where doing so would deprive an essential obligation of its substance.

Neither party is liable for a failure caused by an event beyond its reasonable control that could not reasonably have been anticipated at the time of contracting and whose effects cannot be avoided by appropriate measures. The affected party must inform the other party as soon as reasonably possible and mitigate the consequences.

ShawarmaSec may update these Terms to reflect changes to the platform, services, law, security practices or service providers. The updated version will be published with a new effective date. A material change will be notified where required by law or appropriate in light of its consequences. Changes do not affect an order already accepted unless the parties agree otherwise or the change is legally required.

Complaints should be sent to help@dualguard.xyz with the user’s identity, the relevant programme or order, the facts relied on and the remedy sought. The parties will use reasonable efforts to resolve professional-client disputes amicably before proceedings are issued.

For professional clients, any dispute concerning the validity, interpretation or performance of an order or these Terms is subject to the exclusive jurisdiction of the competent courts of Paris, including in the event of multiple defendants or third-party claims.

Where a user qualifies as a consumer, mandatory consumer jurisdiction and dispute-resolution rules remain unaffected.

These Terms are governed by French law, without prejudice to mandatory provisions that apply to a consumer or another protected user.

If any provision is held invalid or unenforceable, the remaining provisions remain in force. The parties will replace the affected provision with a valid provision that most closely reflects its economic and legal purpose.

These Terms are drafted in English for international participants. English is the contractual language unless otherwise agreed in writing.