Sentrint: open-source software and fonts it ships
==================================================

Sentrint's own code, brand, logo and copy are Sentrint's. The parts below are
other people's work, used under their licences. Each full licence text sits
next to this file or next to the component.

Component        Version   Licence        Where it is used                 Licence text
---------        -------   -------        ----------------                 ------------
Carbon icons     11.89.0   Apache-2.0     app icons (partials/_icon.html)  carbon-icons-LICENSE.txt
                 (c) IBM Corp. Path data copied unchanged; no IBM product or
                 logo glyphs are used. Sentrint is not affiliated with IBM.
d3               7.9.0     ISC            code and dependency maps         d3-LICENSE.txt
uPlot            1.6.31    MIT            trend charts                     uplot-LICENSE.txt
htmx             2.0.4     0BSD           page interactions                htmx-LICENSE.txt
htmx SSE ext.    2.x       0BSD           live scan progress               htmx-ext-sse-LICENSE.txt
Devicon          2.16.0    MIT            language logos (static/langs)    devicon-LICENSE.txt
                 The logos are trademarks of their owners and are shown only
                 to name the language a finding is written in.
thinking-orbs    0.3.2     MIT            loading animation                ../vendor/thinking-orbs-LICENSE.txt
blobatar         2.7.0     MIT            account avatars                  ../vendor/blobatar/LICENSE.txt
IBM Plex Sans,   -         SIL OFL 1.1    all text                         ../fonts/OFL.txt
IBM Plex Mono              (c) IBM Corp., Reserved Font Name "Plex"
Spectral         -         SIL OFL 1.1    the "Sentrint" wordmark only     ../fonts/OFL.txt
                 (c) The Spectral Project Authors; loaded from Google Fonts

Effects re-implemented without React after libraries.dev (MIT, (c) 2026 Jakub
Antalik; no code copied): border-beam (the running-scan border, app.css) and
liquid-gooey (the melting switch highlight, static/goo.js).

Design references (no code or assets copied): the Carbon Design System's
published guidelines, Shopify Polaris patterns, and public dashboard examples
from Geckoboard, Figma and Qlik, used as inspiration only.

Test-only, not shipped to users: axe-core 4.10.3 (MPL-2.0),
tests/a11y/harness/AXE_LICENSE.txt.


Security data shown in reports
==============================

MITRE CWE, CAPEC and ATT&CK       weakness, attack pattern and technique names and
                                  descriptions (finding details, attack paths, the
                                  CWE lookup tool).
    (c) The MITRE Corporation. This work is reproduced and distributed with the
    permission of The MITRE Corporation. MITRE ATT&CK(R) and ATT&CK(R) are
    registered trademarks of The MITRE Corporation.

GitHub Advisory Database          dependency advisories, through OSV and Trivy.
    (c) GitHub, Inc. Licensed under Creative Commons Attribution 4.0
    (CC BY 4.0), https://creativecommons.org/licenses/by/4.0/. Advisory text is
    shown as published, apart from length limits.

OSV (osv.dev)                     open-source vulnerability records; each record
                                  keeps the licence of the database it came from.

Trivy vulnerability database      advisories collected by Aqua Security from public
                                  feeds, including the US National Vulnerability
                                  Database. This product uses data from the NVD but
                                  is not endorsed or certified by the NVD.

CISA Known Exploited              US government work, in the public domain.
Vulnerabilities catalog

EPSS (FIRST.org)                  exploit-likelihood scores, from FIRST's public
                                  EPSS data.


Scanners run on Sentrint's servers (not distributed to users)
=============================================================

Opengrep (LGPL-2.1), Gitleaks (MIT), Trivy (Apache-2.0) and OSV-Scanner
(Apache-2.0) run as separate programs on Sentrint's servers. The code rules they
use are Sentrint's own (sentrint/scanner/rules); no Semgrep Registry rules are
used.


Other companies' names and logos
================================

Product names and logos shown on Sentrint's pages (for example the AI coding
tools a fix prompt is written for, the apps the MCP server connects to, sign-in
providers and language logos) are trademarks of their owners. They are shown only
to say what Sentrint works with. Sentrint is not affiliated with, sponsored by or
endorsed by any of them.