Terms of service

What Firetruck does

Firetruck checks a package and version against the Known Exploited Vulnerabilities (KEV) catalog published by CISA, and returns whether it is listed, along with the related CVEs. It also lists the latest catalog entries and scans lockfiles and SBOMs you submit.

Firetruck is in beta. Features, endpoints and limits can change, and we may add, change or remove them.

Accounts, organizations and API keys

You can look up packages and call the API without an account or an API key. If you choose to sign in and create an API key, you must give us an email address you control and keep it accurate.

An API key is a credential. Keep it secret, don't commit it to a public repository, and revoke it if you think it has leaked. You are responsible for activity that uses your keys. Tell us at privacy@firetruck.dev if you suspect misuse.

Every account belongs to an organization. An organization's owner can add and remove members and manage its keys, and confirms they have the right to add each person they invite. See the privacy notice for what members can see about each other.

Acceptable use

You agree not to:

• attack, overload or probe Firetruck for weaknesses outside a good-faith report to us, or get around rate limits or other technical controls;
• share a key between unrelated people or organizations, or resell or sublicense access to the API;
• use Firetruck to break the law or to violate other people's rights;
• submit data you have no right to submit, or malicious content in lockfiles or SBOMs;
• misrepresent a result as an official CISA statement, or imply that CISA or any other third party endorses Firetruck.

We may rate-limit, restrict or suspend access, and revoke keys, to protect Firetruck or other users, or if you breach these terms. When practical and safe we will tell you why.

Data and accuracy

Results are built from third-party public data, including CISA's KEV catalog and public vulnerability and package records, and from our own matching of packages and versions to that data. That data can be late, incomplete or wrong, and matching can miss a vulnerable version or flag a safe one.

A result of "not found" or "couldn't verify" does not mean a package is free of vulnerabilities or safe to use. Firetruck checks one list of known exploited vulnerabilities and is not a full security audit. You remain responsible for your own security decisions and for how you act on a result, including whether you let it fail a build or release.

Your data

You keep any rights you have in what you submit, such as package names and lockfiles. You give us permission to process it to run Firetruck for you, as described in the privacy notice. We don't claim ownership of it.

Our software and content

Firetruck, its name, its design and its server software belong to us or our licensors. We don't release the server source code, and these terms give you only the right to use the service as described here.

The KEV catalog and other third-party data stay under their publishers' terms.

Availability and changes

We aim to keep Firetruck running but don't promise it will be available, uninterrupted or error-free, and we may stop or change it, including with limited notice during beta. Don't rely on it as the only control that stops a vulnerable release.

Checking packages and using the API are free. Other features may have their own terms or charges. If we introduce a charge, we will say so before you are charged.

No warranty and limit of liability

Firetruck is provided "as is" and "as available". To the extent the law allows, we give no warranties, express or implied, including that results are accurate or complete, or that Firetruck suits a particular purpose.

To the extent the law allows, we are not liable for indirect or consequential loss, or for lost profits, data or business, arising from your use of Firetruck, and our total liability for any claim is limited to the greater of what you paid us in the 2 months before the claim and $100. This doesn't reduce any mandatory rights you have as a consumer.

Ending your use

You can stop using Firetruck at any time, and revoke any API keys you created. To close your account and erase your data, email privacy@firetruck.dev. We may suspend or end your access if you breach these terms, if the law requires it, or if we stop offering Firetruck. Sections that by their nature should survive, such as data accuracy and liability, continue after that.

Changes to these terms

We will update the date at the top when these terms change. For a material change we will give notice on the site or by email before it takes effect. If you keep using Firetruck after that, you accept the new terms.

Contact

For any question about these terms, email privacy@firetruck.dev.