Third-party notices
Every third-party component SiteGuardia ships or invokes, its licence, and what that licence obliges us to do.
Version 2026-09-22Updated 2026-09-22
This is a working draft. It describes the system as built and has not yet been reviewed by a qualified lawyer.
This document is a working draft. It has not been reviewed by a qualified lawyer and will be before SiteGuardia operates commercially. Nothing here is legal advice.
SiteGuardia is built on work other people published under licences that ask for something in return. This page is what they ask for: the component, the licence, and what we do about it. The Terms of Service say this document exists, and until now it did not have a public address.
The one that needs real attention
testssl.sh, GPL-2.0
testssl.sh is the only GPL component in the system, and the obligations are specific enough to state plainly.
What we do:
- It is invoked as a separate process. No part of it is linked into, imported by, or copied into SiteGuardia code. The TLS scanner runs it and parses its JSON output.
- The image installs the upstream release unmodified, with its
LICENSEfile intact. The build asserts that file is present and fails if it is not. - We do not distribute the image publicly. If that changes, the GPL source-offer obligation attaches and has to be satisfied before the image ships.
What we do not do: modify it, redistribute a modified version, or embed any of its code in a proprietary component.
Before commercial launch, a lawyer should confirm this reading, particularly around whether operating it as a hosted service creates any distribution obligation in the relevant jurisdiction. That review has not happened.
Source: https://github.com/testssl/testssl.sh
Scanning tools
| Component | Version | Licence | How it is used |
|---|---|---|---|
| ProjectDiscovery Nuclei | v3.11.1 | MIT | Invoked as a process, restricted to a curated template allowlist |
| Nuclei templates | pinned commit | MIT | Only the allowlisted templates are present in the image |
| ProjectDiscovery httpx | v1.12.0 | MIT | Invoked as a process for HTTP reconnaissance |
| OWASP ZAP | 2.17.0 | Apache-2.0 | Baseline mode only; active-scan entrypoints are removed from the image |
| testssl.sh | 3.2.4 | GPL-2.0 | See above |
MIT and Apache-2.0 both require the licence text and the copyright notice to travel with the distribution. The upstream images and binaries carry theirs, and we do not strip them.
Apache-2.0 also requires a NOTICE file to be reproduced where one exists. The ZAP image carries its own; we do not remove it.
The report renderer
A report is turned into a PDF by a separate service that runs a browser. It is the newest part of the system and it carries the largest third-party component in it.
| Component | Version | Licence | How it is used |
|---|---|---|---|
| Playwright for Python | 1.56.0 | Apache-2.0 | Drives the browser that prints the document |
| Chromium | as shipped with Playwright 1.56.0 | BSD-3-Clause, with components under other licences | Renders the print stylesheet and produces the PDF |
| Microsoft Playwright base image | v1.56.0-noble | Image contents under their own licences; Ubuntu base under its own terms | Carries Chromium and the system libraries it needs |
Chromium is a large work with many components, and not all of them are BSD-3-Clause: it includes code under LGPL, MPL and others, and its own build lists them. We use the binary Playwright ships, unmodified, as a subprocess. We do not redistribute it.
The document the renderer produces uses no remote font, stylesheet, image or script. Every typeface in a SiteGuardia PDF is one already installed on the machine that opens it, which is a privacy decision first and a licensing simplification second.
Application runtime
| Component | Licence |
|---|---|
| Python | PSF-2.0 |
| FastAPI | MIT |
| Starlette | BSD-3-Clause |
| Uvicorn | BSD-3-Clause |
| Pydantic | MIT |
| SQLAlchemy | MIT |
| Alembic | MIT |
| psycopg | LGPL-3.0 |
| redis-py | MIT |
| httpx | BSD-3-Clause |
| dnspython | ISC |
| PyYAML | MIT |
| tldextract | BSD-3-Clause |
| idna | BSD-3-Clause |
| greenlet | MIT and PSF-2.0 |
| pyee | MIT |
psycopg is LGPL-3.0, which is worth noting rather than burying. We use it as an unmodified library through its public interface, which is what the LGPL permits without further obligation. Modifying it, or statically linking it into something we distribute, would change that.
Web
| Component | Licence |
|---|---|
| Next.js | MIT |
| React | MIT |
| Tailwind CSS | MIT |
| Geist Sans and Geist Mono | SIL OFL 1.1 |
| Phosphor Icons | MIT |
The Geist fonts are SIL OFL 1.1. The licence permits bundling and web use, requires the licence to travel with the font files, and forbids selling the fonts on their own. The geist package carries its licence; we self-host the files it provides and do not rename them.
The illustrations on this site are drawn for it. They are not third-party assets and carry no external licence.
Infrastructure
| Component | Licence |
|---|---|
| Caddy | Apache-2.0 |
| PostgreSQL | PostgreSQL Licence |
| Redis | RSALv2 and SSPLv1 |
| Docker images derived from Debian and Ubuntu | Their own terms, per package |
Redis changed licence in 2024. We run it as an unmodified server for our own service and do not offer it to anyone as a managed product, which is the use the new terms restrict. A lawyer should confirm that reading before launch.
Data sources
| Source | Terms | How we use it |
|---|---|---|
| CISA Known Exploited Vulnerabilities | US Government work, public domain | Prioritisation only, never as a claim of exploitability |
| NVD and CVE | Public | Metadata enrichment. Source and retrieval date recorded with each datum |
| IANA special-purpose address registries | Public | Source for the blocked-network policy |
| Public Suffix List | MPL-2.0 | Bundled with tldextract, used to derive the registrable domain |
A KEV match is never presented as proof that a target is exploitable. The report schema enforces this structurally: a version-based observation is recorded as a hypothesis and cannot cap a score.
Build and test only
Not shipped in any runtime image: Playwright for Node, axe-core, Semgrep, Ruff, pytest, pypdf, Trivy, gitleaks and pip-audit. Their licences apply to the development environment and create no distribution obligation.
Keeping this current
This document is reviewed when a dependency changes, and the build fails if a lock file names a package with no entry here. A notices file that has drifted from the dependency set is worse than none, because it is evidence of a review that did not happen.
What is still outstanding: the Chromium component inventory is summarised rather than enumerated, and the Redis and testssl.sh readings above are ours rather than a lawyer's. Both are on the list for the legal review.
Last verified: 22 September 2026.