Production Risk Review — Engagement Terms
Version 2026-10-14 · Stackbilt LLC, a Texas limited liability company
This is the current version. Permanent link: /production-risk-review/terms/2026-10-14
Effective: for purchases made on or after the date this version is published at stackbilder.com/production-risk-review/terms
These terms govern a Production Risk Review ("the Review") that Stackbilt LLC, a Texas limited liability company ("Stackbilt", "we"), performs for the customer named at purchase ("the Client", "you"). You accept them by ticking the acceptance box at checkout, on behalf of the Client, and you confirm you have authority to do so.
1. What we do
1.1 Scope. We perform a read-only review of the source code in one repository you name ("the Repository"), against the Stackbilt checklist version stated in the Report, whose controls are listed in full in the Report. Systems, services, accounts and repositories other than the Repository are out of scope; controls that live there are recorded as NOT VERIFIABLE. If you choose to share exported configuration with us, we may take it into account, but we do not access your running systems.
1.2 Deliverables and timing. Within three (3) business days after we confirm working read-only access ("Access Date"), we deliver: (a) a written report of findings, control coverage and a remediation plan ("the Report"); (b) a thirty (30) minute findings call, booked within fourteen (14) days of delivery; and (c) on request, a signed findings letter in the form we provide before purchase ("the Findings Letter"), but only while Stackbilt holds professional liability insurance covering Findings Letters. If it does not when you request one, we tell you, and you receive the Report without a Findings Letter. The sales page states whether Findings Letters are currently available. The delivery date moves by any delay caused by you, by an unclear or changed scope, or by events under Section 9.8. If we deliver the Report more than five (5) business days after the date due under this section, you may cancel by email before delivery for a full refund.
1.3 Re-checks. One round of re-checking your fixes is included if you request it within thirty (30) days of delivery. A re-check verifies the fixes for the findings you name, at a commit you name ("the Final Commit"); it is not a fresh review of other code that changed after the commit we first reviewed ("the Initial Commit"). The Report records, for each finding, the commit at which its fix was re-checked.
1.4 Method and tools. We use automated tools and AI models to assist the Review. Kurt Overmier, the named reviewer, personally verifies every Critical and High finding and signs the Findings Letter.
1.5 Critical findings. If we confirm a Critical finding during the Review, we notify you by email as soon as it is confirmed, without waiting for the Report.
2. What the Review is not
2.1 The Review is a point-in-time source code review. It is not a penetration test or other testing of running systems; a HIPAA risk analysis, SOC 2 report, ISO 27001 certification, PCI DSS assessment or any other compliance assessment or certification; a review of any code other than the Initial Commit and the re-checked fixes at the Final Commit; or a determination that the application is ready for production or fit for any particular purpose.
2.2 A source review cannot find every defect or vulnerability, cannot readily detect runtime errors, and cannot establish that production runs the reviewed code. We do not warrant that the Review will identify all issues, or that the application is secure or will not be breached.
3. Your responsibilities
3.1 You grant us read-only access to the Repository through a least-privilege, revocable method, and revoke it after the findings call or the re-check, whichever is later.
3.2 You will not provide credentials, secrets, production data or personal data of your users. If any reach us in the Repository or otherwise, we will not use them and will not test them against any live system.
3.3 You confirm you own the Repository or are authorised to grant us access to it for this purpose.
3.4 Decisions about deploying, fixing, or relying on the application remain yours.
4. Confidentiality and data
4.1 We keep the Repository, the Report and anything you tell us about your business confidential, use them only to perform the Review, and do not disclose them except: to subcontracted reviewers bound by equivalent duties; to third-party AI service providers that process the Repository on our behalf under their commercial terms; or as the law requires. You can ask us which providers we use before granting access.
4.2 We clone the Repository only to a working environment we control, never into our own repositories. We delete our copy of the Repository, and any credentials or data covered by Section 3.2, within thirty (30) days after the later of delivery or completion of the re-check. We keep the Report and our working notes for two (2) years to verify Findings Letter IDs and respond to questions.
4.3 If we confirm unauthorised access to our copy of the Repository, the Report or our working notes, or to your content at an AI service provider we use, we notify you within seventy-two (72) hours of confirming it.
4.4 We may describe the engagement publicly only in anonymised form and only with your written permission.
5. Ownership
5.1 You keep all rights in your code. You own the Report and Findings Letter as delivered, and may use them for your own business.
5.2 We keep all rights in our checklist, methods, templates and tools, including anything we learn about reviewing applications in general.
6. The Findings Letter: sharing and reliance
6.1 Sharing. You may share the Findings Letter only in full and unaltered, with your actual and prospective customers, partners, investors, insurers and auditors ("Recipients"). You may not share excerpts of it, or describe it as a certification, penetration test, compliance assessment or warranty. The Report is for your internal use; if you share it, the same rules apply.
6.2 Purpose. The Findings Letter is provided to the Client. Recipients receive it for information only, as evidence that a source review of the named commits took place and of the findings it records. It speaks only as of the Final Commit, and we have no obligation to update it.
6.3 No third-party reliance. The Findings Letter is not intended to induce reliance by any Recipient. To the fullest extent permitted by law, Stackbilt undertakes no duty to any Recipient. No Recipient is a third-party beneficiary of these terms, and the Findings Letter and Report are not a representation or warranty about the application to anyone.
6.4 CLIENT INDEMNITY FOR MISUSE. YOU WILL INDEMNIFY AND DEFEND STACKBILT AGAINST CLAIMS BY A RECIPIENT TO THE EXTENT THEY ARISE FROM YOUR BREACH OF SECTION 6.1: SHARING AN ALTERED OR PARTIAL FINDINGS LETTER OR REPORT, OR DESCRIBING EITHER AS A CERTIFICATION, PENETRATION TEST, COMPLIANCE ASSESSMENT OR WARRANTY. THIS INDEMNITY DOES NOT COVER CLAIMS ARISING FROM STACKBILT'S OWN NEGLIGENCE, FRAUD, GROSS NEGLIGENCE OR WILFUL MISCONDUCT.
6.5 Withdrawal. If we learn that the Findings Letter materially misstates a finding at the commit it names, we will tell you, and you will stop sharing that letter until we issue a corrected one.
7. Fees and refunds
7.1 The fee is the price shown at checkout, paid in advance.
7.2 If we have not received working access within thirty (30) days of purchase, or we decline the engagement (for example, the Repository is out of scope), we refund the fee in full. Section 1.2 sets out your right to cancel for late delivery. Once we have delivered the Report, the fee is not refundable.
7.3 If you start a Stackbilt hardening sprint within thirty (30) days of delivery, the full Review fee is credited toward the sprint.
8. LIMITATION OF LIABILITY — PLEASE READ CAREFULLY
8.1 CAP. TO THE FULLEST EXTENT PERMITTED BY LAW, STACKBILT'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THE REVIEW, THE REPORT AND THE FINDINGS LETTER, WHETHER IN CONTRACT, TORT (INCLUDING STACKBILT'S OWN NEGLIGENCE) OR ANY OTHER THEORY, IS LIMITED TO THE FEES YOU PAID FOR THAT REVIEW.
8.2 EXCLUDED LOSSES. TO THE FULLEST EXTENT PERMITTED BY LAW, STACKBILT IS NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, INCLUDING LOSSES FROM A SECURITY INCIDENT, EVEN IF ADVISED OF THEIR POSSIBILITY, AND EVEN IF THEY ARISE FROM STACKBILT'S OWN NEGLIGENCE.
8.3 EXCEPTIONS. SECTIONS 8.1 AND 8.2 DO NOT LIMIT LIABILITY FOR STACKBILT'S FRAUD, GROSS NEGLIGENCE OR WILFUL MISCONDUCT, WHETHER THE CLAIM IS IN TORT OR CONTRACT. NOTWITHSTANDING SECTIONS 8.1 AND 8.2, STACKBILT'S TOTAL LIABILITY FOR BREACH OF SECTION 4, INCLUDING DIRECT LOSSES FROM A SECURITY INCIDENT CAUSED BY THAT BREACH, IS LIMITED TO FIVE THOUSAND U.S. DOLLARS ($5,000).
8.4 NOTHING IN THESE TERMS WAIVES ANY RIGHT THAT CANNOT BE WAIVED BY LAW.
9. General
9.1 Independence. Stackbilt will not issue a Findings Letter for a Repository containing code that Stackbilt wrote or modified, including fixes made in a Stackbilt hardening sprint. If you plan to buy a hardening sprint and also want a Findings Letter, ask us before the sprint starts.
9.2 Relationship. We are an independent contractor. Nothing in these terms creates a partnership, agency or fiduciary relationship.
9.3 Disputes. Before starting any legal proceeding, a party gives the other written notice of the dispute and thirty (30) days to resolve it.
9.4 Governing law and venue. These terms are governed by the laws of the State of Texas, without regard to conflict-of-laws rules. The parties submit to the jurisdiction of the state and federal courts located in Texas.
9.5 Entire agreement and precedence. These terms, together with the order details at checkout, are the entire agreement for the Review. For the Review, they control over the Stackbilder Terms of Service and over the Findings Letter.
9.6 Changes. We may update these terms for future purchases. The version you accepted at purchase governs your Review.
9.7 Notices. Notices go by email to admin@stackbilt.dev, and to the email address used at checkout.
9.8 Events beyond our control. Neither party is liable for delay caused by events beyond its reasonable control, other than payment obligations.
9.9 Assignment. Neither party may assign these terms without the other's consent, except to a successor to its business.
9.10 Survival. Sections 4, 5, 6, 8 and 9 survive completion of the Review.
9.11 Severability. If any provision is unenforceable, the rest remains in effect and the provision is enforced to the maximum extent permitted.
Stackbilt LLC · admin@stackbilt.dev