Legal · terms of use

Terms of use

Last updated 22 October 2026. These terms cover this website (enigmaticred.com), the hosted chat interface on its own subdomain (beta.enigmaticred.com), and the beta software this site offers for download. By using any of them you accept these terms. If you do not accept them, do not use the site, the interface or the software — there is nothing to cancel, no account to close and no charge to reverse. What this site does with data is in the privacy policy, which is part of these terms.

Who this is

Enigmatic Red is an independent research project, run by an individual. It is not a company: there is no registered company number and no entity behind it. The one address that reaches a person is info@enigmaticred.com, and it is the address to use for security reports, takedown requests and anything these terms raise.

The trade mark

Enigmatic Red™ — the name and the mark are the subject of a trade mark application filed with the Trade Marks Registry of the Intellectual Property Department of the Hong Kong Special Administrative Region on 22 October 2026:

Application number 307447311, filing receipt N000943113.
One class, class 42: computer software research and development; cyber security vulnerability research, analysis and threat-intelligence services; adversarial testing and safety auditing of artificial intelligence models, large language models and machine-learning systems; computer systems vulnerability assessment and penetration testing; open-source software development services.
Applicant: MAK, Yat Long, the individual who runs this project.

The application has been filed and paid for and is pending. It is not a registered trade mark. That is why this site writes Enigmatic Red™ and never ®: the symbol used here says that a claim exists and has a date and a number, not that a register has granted one. A pending application can be refused or opposed, and no page here will say otherwise before a certificate says so.

A filed application gives no right to stop anyone from doing anything yet, and no right is claimed against anyone as though it did. If you believe the mark or anything on this site conflicts with a right of yours, write to the address above with the details and it will be looked at.

The name and the mark are not licensed to visitors: you may say that you use or write about Enigmatic Red, and you may not use the name or the mark to suggest that this project endorses, sponsors or is affiliated with anything without written permission. Nominative references to the project are welcome and need no permission.

The site, and the one thing it hosts

This website is a static page and its images. It has no account, no sign-up, no cookie, no analytics and no script — nothing on it keeps state in your browser, and nothing on it sends your reading anywhere. The downloads it offers are the files the page describes, with their byte counts and their SHA-256 digests printed beside them so you can check what arrived.

The one hosted convenience is a chat interface on beta.enigmaticred.com. It exists because trying the agent used to mean installing it first. It is bring your own key: you paste a key you hold for a model provider, and the bill for an answer belongs to you and to that provider. A request without a key is refused. This deployment holds no model credential of its own, so it cannot pay for anyone's turn — and it cannot be used without one either.

What the chat interface does, and what it does not do

It answers questions, and it runs nothing. That sentence is the whole contract of that page, and it is enforced rather than promised:

It cannot touch a host, a file, a credential or a network. There is no tool runner behind it, no shell and no scanner, and no way to add one from the browser: the interface holds no capability, so no setting can conjure one.
What the model proposes as an action is returned to you as a suggestion and labelled as one. It is never executed, and the page says so in the answer it hands back.
The key you paste travels from your browser to the endpoint in a request header, is used for that one upstream call, and is never logged, echoed back, or written to any counter.
No message of yours is stored and no log line about one is written. The only record is a short-lived rate-limit counter, keyed to a salted hash of your network address, which cannot be turned back into the address.
The endpoint posts only to model providers the deployment itself configures. It cannot be pointed at an arbitrary host, because an endpoint that holds somebody else's key and honours an arbitrary destination is an open proxy.

You still choose the provider and the model, and your words travel to the one you chose — which means that, for that turn, that provider's terms and privacy policy apply to your prompt and your key, not ours. Do not paste anything into it that you would not send to the provider you selected. The privacy policy sets out exactly what leaves your browser.

The beta software, and authorised testing only

The thing that acts is the beta you install and run on your own machine: a wheel, or on Windows an installer that wraps it. It runs locally against a target you configure, and it is built for testing you are entitled to do. That is not a slogan on this site, it is a gate in the software: a scan does not start without a scope, an authorization record and a target that proves ownership; the action guard classifies every command before it runs; intrusive commands need a human approval for that exact command line; and every decision is written to a hash-chained audit log you can read yourself.

You are responsible for authorisation. Every target you point it at must be covered by a signed, dated authorisation that names it, or be yours to test. Using it against anything else is your act, not this project's, and may be an offence where you are.
It is built to refuse. A permanently forbidden pattern — denial of service, credential brute force, persistence, destructive filesystem and SQL operations, reverse shells and command-and-control, bulk exfiltration — cannot be enabled by configuration and cannot be approved by a human. Expect refusals to outnumber findings; each refusal is logged, which is the point.
It can be wrong. A verified finding and a lead are kept apart on purpose, and a capability with no adapter is reported as not tested rather than as absent. Read a report as evidence with its limits, never as an assurance that a system is safe.
It is a beta. Interfaces, adapters and report shapes change between versions, and a scan consumes model tokens that you pay for, bounded by the per-scan limits the front page states.

This is an assessment tool, not a red team. It finds and proves what an authorised target exposes; it does not close the gap a person would. By design it does not act as a goal-directed adversary, or test whether your people and processes notice it; measure whether your defences and detection rules noticed it; run continuously from inside your estate; develop exploit code, analyse a malware sample or run command-and-control; touch people or places - no social engineering, no phishing and no physical testing; assess wireless networks, radio or hardware; test a mobile application; or review source code for flaws, run a tabletop exercise or build a threat model. No configuration, no approval and no prompt can make it do those things, because they are refused by the action guard rather than switched off in a setting. Where a discipline is only partly covered, the report says so and a human finishes the job.

Authorisation is not the same as safety. A scan that changes nothing still sends traffic, still opens connections and can still disturb a fragile system - a single-request probe can be enough to notice, and rate limits bound that rather than remove it. Nothing here is a guarantee that a run was free of effect; that is what the audit log and the approval record are for, and why the signed attestation has to name the target before the first packet leaves.

Acceptable use

You agree not to use this site, the interface or the software to:

test, scan or otherwise touch any system you do not own and are not authorised in writing to test;
send denial-of-service traffic, brute-force credentials, install persistence, destroy or exfiltrate data, or reach cloud metadata services through a target;
send unlawful, infringing, harassing or deceptive content through the chat interface, or send anyone's personal data that you have no right to send;
use a key you do not hold, evade a rate limit, or try to make the endpoint reach a host or a model it was not configured with;
copy, resell, sublicense or rehost the software or the brand as your own, or strip a copyright, trade mark or licence notice from either.

Access may be refused or withdrawn at any time for any of the above — the endpoint is metered and can simply stop answering — and it fails closed: a missing key, a missing counter or a missing binding answers with a refusal naming what is missing, never with an unmetered call.

Content and ownership

The text, the design, the brand files and the software on this site are the project's, with all rights reserved. No licence is granted by this site or by downloading the beta: the public source repository is not published yet, the wheel is a snapshot offered so it can be tried and evaluated, and redistributing it is not permitted. The figures, commands and captures on the front page are published so they can be checked, and quoting them with attribution is welcome.

What you type into the chat stays yours, and the sentence you send is passed to the provider you chose on your behalf; nothing else in these terms takes any right in it.

No warranty

The site, the interface and the beta software are provided “as is” and “as available”, without warranty of any kind, express or implied, including any warranty of merchantability, fitness for a particular purpose, accuracy or non-infringement. No promise is made about uptime: the chat interface is a hosted convenience that may be changed, limited or switched off at any time, and the beta reaches you with no support commitment. Nothing on this site is security advice, a certification, or a statement that any system is safe.

Limit of liability

To the fullest extent permitted by law, the project and its operator are not liable for any indirect, incidental, special or consequential loss, or for any loss of data, profit, business or goodwill, arising from the site, the interface or the software — including anything you do with them, or any use of the software against a system you were not authorised to test. Where liability cannot be excluded, it is limited to HK$100. Nothing here excludes liability that the law does not allow to be excluded, and nothing here takes away a right you have as a consumer which cannot be waived.

Privacy

The privacy policy is part of these terms. In one line: this site sets no cookie, keeps no account and stores no message, and the only thing the chat endpoint records is a short-lived, non-reversible rate-limit counter.

Changes, law and contact

These terms may change; the date at the top changes with them, and the version in force is the one on this page when you use the site. Facts that can be checked — the trade mark application number, its date, its class and its status — are pinned by a test in this repository, so they cannot drift from what was filed without the suite failing. A court applying consumer law where you live may give you rights these terms cannot take away; beyond that, these terms are governed by the laws of the Hong Kong Special Administrative Region. Write to info@enigmaticred.com.