Our customer wants to run IBM Rational AppScan on our website. What legal agreement should we have in place to protect each party and what concerns should I have before letting them run it? What does AppScan check for and is there a risk it can delete or mess up our database? They want to have an agreement in place before they run it, so we can't sue them. And I'm scared they're going to crash our system or truncate our database.
In response to some of the answers, the website is not publicly available. It requires a username and password. Also, the scan is required, the customer is a Fortune 100 company, and we want their business. I think the best option is to have them run it on a test bed.