Kestrix
Copyright 2026 Ruthvik Bandari

The Bitcoin quantum-risk module is adapted from BitShield (MIT Bitcoin Expo 2026, Team ACE).
The forensics module is adapted from CyberSafeX Detection Suite (MIT License, Ruthvik Bandari).

The code scanner's rules (packages/kestrix-scan/src/kestrix_scan/registry.py) were written for Kestrix from their CWE entries
and the language, library and standard documentation cited per rule in
docs/modules/code-rules-provenance.md. No rule text, pattern or code from other scanners is included.

Dependency scanning (packages/kestrix-scan/src/kestrix_scan/osvdb.py, deps.py, versions.py, lockfiles.py):
no advisory data is included in this repository or in the kestrix-scan package. `kestrix-scan db update`
downloads it to the user's cache from OSV (https://osv.dev, https://google.github.io/osv.dev/data/), and
findings and install-guard messages quote advisory ids and summaries from it. OSV redistributes each source
under that source's license; the sources present in the PyPI and npm exports (checked 2026-10-20) are:

- GitHub Advisory Database (GHSA- ids), GitHub, Inc.: CC-BY 4.0. https://github.com/github/advisory-database
- PyPI Advisory Database (PYSEC- ids), Python Packaging Authority: CC-BY 4.0. https://github.com/pypa/advisory-database
- OpenSSF Malicious Packages (MAL- ids), Open Source Security Foundation: Apache-2.0.
  https://github.com/ossf/malicious-packages
- OSS-Fuzz (OSV- ids), Google: CC-BY 4.0. https://github.com/google/oss-fuzz-vulns
- Erlang Ecosystem Foundation CNA (EEF- ids): CC-BY 4.0. https://github.com/erlef/security-database
- Global Security Database (GSD- ids), Cloud Security Alliance: CC0 1.0. https://github.com/cloudsecurityalliance/gsd-database

The OSV schema (https://ossf.github.io/osv-schema/) is Apache-2.0. PEP 440 version ordering and SemVer 2.0
precedence were implemented for Kestrix from the PEP 440 text (public domain) and the SemVer specification
(CC BY 3.0); no code from `packaging` or any other version library is included. The CVSS v3.1 base-score
formula follows the FIRST CVSS v3.1 specification (https://www.first.org/cvss/v3.1/specification-document).
The tests use synthetic advisories only.

The dashboard build (src/kestrix/server/static/) bundles React, react-dom and scheduler, react-router,
TanStack Query, cookie-es and @remix-run/route-pattern (MIT), Lucide icons from lucide-react (ISC; brand
logos such as Google and GitHub are not Lucide icons) and the IBM Plex Sans and Mono fonts via Fontsource
(SIL Open Font License 1.1). Their full licence texts ship with the build as THIRD_PARTY_LICENSES.txt,
which scripts/build_third_party_licenses.py writes to frontend/public/ from the installed packages.

Third-party notices policy: third-party code, rules or data are added to this repository only under a
license that permits redistribution with Apache-2.0, and each addition is recorded in this file with its
source, copyright holder and license in the same change. Datasets for the code-vulnerability research are
not redistributed; their licenses and usage tiers are recorded in docs/research/dataset-licenses.md.
