Legal

sbomtriage is a personal project, free during early access. These pages explain what it does with your data and what you agree to by using it. Where a detail hasn’t been published yet, the page says so instead of guessing.

Privacy
What’s collected, why, on what legal basis, for how long, and your rights over it.
Terms
What the service promises and what it doesn’t, including the limits of the analysis.
Data processing terms
How data you upload on behalf of an organisation is processed. They form part of the terms when you use the service for an organisation.
Subprocessors
The outside services that receive your data, and what each one sees.
Acceptable use
What you may and may not do with the service, including security testing.
Data sources
Where the vulnerability data comes from, and the licences and credits that go with it.
Imprint
Who operates the service, as far as that’s been published.
Contact
Where to write, for general questions and for security reports.
Security
How uploads, stored data and the GitHub App are handled, and how to report a vulnerability.
security.txt
Not published yet, because no security contact has been set.

Report illegal content

If you think something reachable through sbomtriage, such as a shared report, contains illegal content, you can send a notice.

No contact address has been published yet, so there’s no channel for notices on this deployment. The operator sets SBOMTRIAGE_LEGAL_CONTACT to fill this in.

Please include:

why you consider the content illegal;
the exact address (URL) of the content, and anything else needed to find it;
your name and email address, unless the notice concerns child sexual abuse material;
a statement that you believe, in good faith, that the notice is accurate and complete.

We’ll confirm that we’ve received your notice, decide on it promptly and carefully, and tell you what we decided and how you can challenge it.