Legal
Transparency and compliance — how we operate, and how we protect you and ourselves.
Scan Disclaimer
Results are indicative, not proof of exploitability. Every finding must be reviewed and validated by a human security professional before any remediation decision. AISG is an assessment tool: you are solely responsible for ensuring you are authorized to scan any target. Unauthorized scanning may violate applicable laws. AISG provides no warranty, express or implied, on the completeness or accuracy of results.
Intellectual Property & Open Source
AISG is a proprietary assessment platform. It orchestrates proven security techniques and open-source components, each executed as an isolated external process without modification. AISG does not claim ownership of, or endorsement from, any third-party project. Trademarks belong to their respective owners.
Full third-party attribution, license texts, and component notices are maintained below, as required by the applicable open-source licenses. The AISG core — engine, correlation, policy, and decision logic — remains proprietary.
Third-Party Notices — Scanner Components
Every scanner below runs as an unmodified, isolated external process (Docker CLI). Licenses verified 2026-08-08.
| Component | License | Used for | Source |
|---|---|---|---|
| bandit | Apache-2.0 | Python SAST (Beginner+) | PyCQA/bandit |
| semgrep | LGPL-2.1 | Multi-language SAST incl. AISG LLM/RAG rules | semgrep/semgrep |
| codeql | MIT (packs) / GitHub CLI terms | Deep-flow SAST (Python/JS) | github/codeql |
| gitleaks | MIT | Secrets in git history | gitleaks/gitleaks |
| trufflehog | AGPL-3.0 | Deep secret scan (Expert+) | trufflesecurity/trufflehog |
| checkov | Apache-2.0 | IaC misconfig (Terraform/CFN) | bridgecrewio/checkov |
| grype | Apache-2.0 | Known-vuln dependencies | anchore/grype |
| osv-scanner | Apache-2.0 | Known-vuln dependencies (OSV) | google/osv-scanner |
| syft | Apache-2.0 | SBOM generation (Expert+) | anchore/syft |
| trivy | Apache-2.0 | Infra misconfig + filesystem secrets (Expert+) | aquasecurity/trivy |
| httpx | MIT | Endpoint/tech discovery (URL) | projectdiscovery/httpx |
| nuclei | MIT | CVE/template scanning (URL) | projectdiscovery/nuclei |
| testssl.sh | GPL-2.0 | TLS configuration audit (URL) | drwetter/testssl.sh |
| dnsx | MIT | DNS enumeration (URL) | projectdiscovery/dnsx |
| subfinder | MIT | Passive subdomain discovery (Deep URL) | projectdiscovery/subfinder |
| zap | Apache-2.0 | Active DAST crawl (Deep URL) | zaproxy/zaproxy |
| schemathesis | MIT | API schema fuzzing (Deep URL) | schemathesis/schemathesis |
| sqlmap | GPL-2.0 | SQLi assessment (catalog, opt-in) | sqlmapproject/sqlmap |
| nmap | NPSL | Port/network scan (catalog) | nmap.org |
| garak | Apache-2.0 | LLM model-level red-team | NVIDIA/garak |
| pyrit | MIT | LLM multi-turn attacks (Microsoft) | Azure/PyRIT |
| promptfoo | MIT | LLM app-level tests (incl. RAG/agent) | promptfoo/promptfoo |
Third-Party Notices — Runtime & Models
| Component | License | Used for | Source |
|---|---|---|---|
| Llama 3.1 (via Ollama) | Llama Community License | Local LLM inference | llama.com |
| FastAPI / Uvicorn / Pydantic | MIT / BSD-3 / MIT | API server | fastapi |
| PyJWT / python-dotenv / PyYAML | MIT / BSD-3 / MIT | Auth & config | pypi.org |
| reportlab / pypdf | BSD-3 / BSD-3 | PDF report generation & validation | reportlab |
| docker SDK / cryptography / google-auth | Apache-2.0 / Apache-2.0·BSD / Apache-2.0 | Container orchestration, secret encryption, Google login | pypi.org |