These terms apply when a seller asks GreenGo to run Green Light checks, to anyone who uses the free quick check, and to anyone who reads a Green Light report or badge. They add to the Terms of Service and the Seller Agreement.
1. What Green Light is
Green Light is an automated, non-intrusive check of a website, web app or downloadable product that a seller lists on GreenGo. Today it includes:
- Header check — the HTTPS setup and security headers of the listing's public home page, scored by the MDN HTTP Observatory, a free service run by Mozilla.
- File check — the product files the seller uploads to GreenGo, scanned for committed secrets and API keys, environment files (such as .env), version-control folders (such as .git), source maps and private keys.
- Deep code scan — the same uploaded files, scanned by two open-source tools: Gitleaks for exposed secrets and keys, and OSV-Scanner, which checks declared dependencies against Google's OSV vulnerability database. A known vulnerability with a CVSS score of 7.0 or higher fails the check; lower severities are shown only to the seller.
The report lists exactly which checks ran. We may add checks under Section 9.
Green Light is not a security audit, penetration test, code review, compliance certification or guarantee. It checks only what is publicly served, or what the seller uploads, on the date shown. It can miss real problems and can flag issues that are not real problems.
1A. Independence from paid services
GreenGo earns a fee when a seller hires a Fixer through the Fix-It Desk. To keep results honest:
- checks, pass thresholds and results are the same whether or not a seller uses the Fix-It Desk;
- no one paid on Fix-It revenue can change a check or a result;
- every failed check says what was found and how to confirm it yourself;
- you never need the Fix-It Desk: fix it yourself or hire anyone, then ask for a free re-check.
Results come only from the automated checks: no one at GreenGo starts, edits or approves an individual result, and no plan, placement or paid service changes a check. We keep a record of each check's logic and every change to it, and publish the current methodology at greengopartners.com/green-light.
2. Authorization — only owners can request checks
- You may request checks only for properties you own or control, and you must prove control by the method we offer, currently a DNS TXT record on the property's domain.
- By requesting checks you give GreenGo express authorization to have the property checked as described in Section 3, now and on the re-check schedule, until you remove the listing or withdraw authorization in Settings.
- You confirm that you have authority to give this authorization, including under the terms of your hosting and service providers, and that the checks will not break any agreement you are bound by.
- GreenGo does not run listing checks on properties whose control has not been verified. Requesting checks on a property you do not control is a serious breach of our Terms.
- Control is re-checked every time. Before each scheduled re-check, GreenGo confirms that the DNS TXT record is still in place. If it is missing, we do not run the check, the badge expires, and we notify the seller. If a domain or app changes hands, the new owner must verify control before any check runs.
3. How checks run
- Header check. GreenGo sends only the property's hostname to the MDN HTTP Observatory. Mozilla's service then requests the public home page and grades the response headers. GreenGo itself sends no requests to your site for this check, other than DNS lookups through a public resolver. Mozilla's own terms and limits apply to its service, and results may be cached for up to 24 hours.
- File check. Runs only on files you upload to GreenGo for delivery to buyers. It makes no network requests to your systems.
- Deep code scan. Runs only on files you upload. GreenGo gives a temporary runner on GitHub Actions (operated by GitHub, Inc.) a download link that expires in 15 minutes. Gitleaks and OSV-Scanner run there; OSV-Scanner sends package names and versions, not your code, to the OSV.dev database run by Google. Secrets are redacted before results leave the runner, and the runner and its copy of your files are deleted when the scan ends.
- Checks run automatically: after you confirm control of the property, within an hour after delivery files change or a result expires, once a day while an issue remains, and weekly for passing listings. You can also start up to 3 checks per day.
- We do not attempt to log in, guess passwords, bypass authentication, exploit vulnerabilities, submit forms that change data, run load tests or access non-public data.
- If we find something sensitive, such as an exposed API key, we stop, record only what is needed to prove the finding (for example, the first and last four characters), tell you privately and never use it.
3A. Free quick check
Anyone may run a free header check of a public hostname at greengopartners.com/check. It uses the same MDN HTTP Observatory service and reads only what the site publicly serves. It gives no badge, creates no listing and is for information only, so do not rely on it as a security assessment. We limit how often it can be used.
3B. Green Light Monitor
Green Light Monitor is an optional subscription for a property whose control you have verified: US$9 per month per property, renewing monthly until you cancel. It runs the header check every week, re-confirms your DNS record, keeps a valid badge current while checks pass, and emails you when a result gets worse. Sellers on the Pro plan get Monitor for the properties of their listed products at no extra charge. You can cancel online at any time in Settings › Billing; cancellation takes effect at the end of the current paid month. Section 6 of the Terms of Service (Subscriptions and automatic renewal) applies.
4. Reports and badges
- What is public. The listing shows the check date, the list of checks that ran and, for each, "No issues found by this check" or "Issues found." Categories that look only for basic signals are labeled "basic signals only" and never show a pass for accessibility, privacy or legal compliance.
- What stays private. Technical details of failed checks, including affected files and how to reproduce them, are shown only to the seller and GreenGo staff, so they cannot be used against the seller's users.
- Badge meaning. A badge means "passed the listed automated checks on the date shown." It always appears as "Green Light checked · [date]" with the line "Automated checks only — not a security audit or certification," and links to the report.
- Expiry. A badge expires automatically 90 days after the last passing check, or as soon as a scheduled re-check fails or is blocked. A new check runs automatically when delivery files change, and changes to a live site are covered by the next automatic check. The badge is not valid for a changed product until a new check passes. We may also expire a badge when we detect a material change.
- Badge license. While a badge is valid, the seller may show it on its own site only through GreenGo's official embed. GreenGo serves and updates the embed; it shows the date and the limit line, links to the report, and disappears when the badge expires. The seller may not copy, alter or screenshot the badge, show it after it expires, or describe it as a certification, audit, guarantee or proof of compliance.
5. Disputes about results
We never edit an individual result. If you think a result is wrong, fix the cause and the check runs again automatically, or write to info@greengopartners.com with the report date and your evidence. If a check itself is wrong, we fix the check for everyone, record the change in the methodology, and affected listings are re-checked automatically.
6. Fix-It Desk
You can choose to share failed-check details with fixers through the Fix-It Desk. Nothing is shared with fixers unless you post a job.
7. Reliance and liability
- Buyers should use Green Light as one input alongside their own judgment. A buyer's remedy for a product that is not as described is Buyer Protection.
- Green Light is provided "as is". To the fullest extent the law allows, GreenGo is not liable for any loss caused by a check missing a problem or flagging one in error, and its total liability relating to Green Light for any seller is limited to the greater of the fees that seller paid GreenGo in the 3 months before the claim or US$1,000. This does not limit liability for GreenGo's gross negligence or willful misconduct, or for harm to the seller's property caused by checks run beyond the limits in Section 3.
8. Data from checks
We do not keep your code after a deep scan. We keep reports and check data (including file names, line numbers, rule names, package names, versions and advisory IDs) as described in the Privacy Policy and may use them in aggregated, de-identified form to improve Green Light and publish general statistics, never identifying a seller's unresolved findings.
9. Changes to checks
We add and refine checks over time. New checks apply at the next scheduled re-check, and we will tell sellers at least 14 days before a new check that could change a passing result.