keyreach
Copyright 2026 Vaibhav Vanage (Phantom-IN)

This product includes software developed by Vaibhav Vanage (Phantom-IN) and the
keyreach contributors.

Licensed under the Apache License, Version 2.0 (the "License"); you may not
use this file except in compliance with the License. You may obtain a copy of
the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
License for the specific language governing permissions and limitations under
the License.

--------------------------------------------------------------------------------
Third-party attributions
--------------------------------------------------------------------------------

This section lists third-party works whose code or data is incorporated into
keyreach, together with the attribution their licenses require. When a source is
incorporated, its entry is added here in the same pull request, along with a
matching full-license entry in THIRD_PARTY_LICENSES.md.

keyreach is permissively licensed. Copyleft works (AGPL/GPL) are STUDIED ONLY
and never copied; they are acknowledged in CREDITS.md and do not appear here,
because no code or data from them is redistributed.

No third-party code or data is currently incorporated into keyreach, so this
section lists no attributions. The two entries previously pre-seeded here were
resolved in roadmap item R0.5 and are recorded below for transparency.

1. secrets-patterns-db  --  NOT REUSED (resolved R0.5)
   Author:    Mazin Ahmed (mazen160)
   Source:    https://github.com/mazen160/secrets-patterns-db
   Verified:  2026-08-11, read from LICENSE.md at commit
              24984df1a3f78475132ed183cebce4452b601161

   This entry previously recorded a planned reuse under CC-BY-4.0. Verifying the
   license from the upstream repository -- which is required before any reuse --
   showed that assumption was wrong, on two independent grounds:

     a. LICENSE.md is "Attribution-ShareAlike 4.0 International"
        (CC-BY-SA-4.0), not CC-BY-4.0. ShareAlike obliges adaptations to carry
        the same license, which is not among the licenses keyreach may reuse.
        The repository's README.md separately claims CC-BY-4.0, contradicting
        its own LICENSE file. An ambiguous grant is read conservatively.

     b. That README.md also states "Trufflehog data is licensed under the
        AGPL". The rule set carries no per-rule provenance, so AGPL-derived
        entries cannot be identified and excluded. keyreach must never copy
        TruffleHog.

   Outcome: nothing is copied. keyreach's detection patterns are written from
   each provider's own public API documentation, and every rule in
   keyreach/patterns/detection_rules.yml records the vendor documentation URL it
   came from. secrets-patterns-db is credited in CREDITS.md as prior art that
   was studied, which requires no attribution here.

2. gitleaks rules  --  NOT REUSED (resolved R0.5)
   Author:    Zachary Rice and the gitleaks contributors
   Source:    https://github.com/gitleaks/gitleaks
   License:   MIT (verified 2026-08-11)

   MIT would permit reuse with attribution, but nothing has been copied.
   gitleaks is used as a behavioural cross-check only, and is credited in
   CREDITS.md. If rules are ever reused, an attribution entry is added here and
   the full MIT license text to THIRD_PARTY_LICENSES.md, in the same pull
   request.

--------------------------------------------------------------------------------
Policy for adding an entry here
--------------------------------------------------------------------------------

Before reusing any third-party code or data:

  1. Verify the license from the upstream repository itself (not from a
     summary, blog post, or package index).
  2. Confirm it is MIT, Apache-2.0, BSD, CC-BY, or another permissive license
     compatible with Apache-2.0 redistribution. If it is AGPL/GPL, STOP — it may
     be studied for behavior and re-implemented from public API documentation
     only, and it is credited in CREDITS.md rather than here.
  3. Add the attribution entry above and the full license text to
     THIRD_PARTY_LICENSES.md in the same pull request.
  4. Add an inline credit header to any source file derived from a specific
     upstream project.
