Vybscan Terms of Service

1. Agreement and parties

These Terms of Service (the "Terms") are a binding agreement between Dheemai Inc., a Delaware corporation ("Dheemai", "we", "us"), and the person or organisation that installs or uses Vybscan ("you", "Customer").

If you install Vybscan on behalf of a GitHub organisation, company, or other entity, you represent that you have authority to bind that entity, and "you" means that entity. If you do not have that authority, or you do not agree to these Terms, do not install or use Vybscan.

Where you and Dheemai have signed a separate order form, master services agreement, or data processing agreement, that document controls over these Terms to the extent of any conflict.

2. The Service

Vybscan is a GitHub App and web dashboard (together, the "Service") that scans repositories, pull requests, and pushes for security and compliance risk. Depending on your configuration this includes:

• Dependency analysis against public vulnerability databases, and detection of malicious, typosquatted, and invented package names.
• Rule-based static analysis of source code and infrastructure-as-code.
• Optional AI-assisted code review, described in Section 7.
• Secrets detection, licence compliance checks, and container and infrastructure checks.
• Reporting through GitHub checks, pull-request comments, optional issues, and the Vybscan dashboard.
• Optional dependency-fix pull requests that you review and merge.

The Service is a decision-support tool for engineering teams. It does not replace secure development practices, code review, penetration testing, or a security programme.

3. GitHub installation and accounts

Vybscan runs inside GitHub. To use it you must have a GitHub account and the authority to install GitHub Apps on the organisation or repositories you select. Your use of GitHub is governed by GitHub's own terms, which are separate from these.

When you install Vybscan you grant it the GitHub permissions shown on the installation screen. As of the date above these are: metadata (read), contents (read), checks (write), pull requests (write), issues (write, optional), and organisation members (read). You may change the repositories Vybscan can access, or uninstall it, at any time through GitHub.

Dashboard access uses GitHub sign-in. Repository visibility in the dashboard mirrors the signed-in user's GitHub permissions. You are responsible for the people who access the Service through your organisation and for keeping your GitHub credentials secure.

4. Plans, trials, and fees

Trial. A new installation receives a trial that includes a fixed number of scan runs. The trial allowance is shown in the dashboard. When it is used up, scanning pauses until you move to a paid plan. Trials are provided "as is" and we may change or withdraw trial allowances at any time.

Paid plans. Paid use is governed by an order form or the plan you accept in writing, which sets out the fees, scan limits, term, and billing schedule. Fees are stated in US dollars, are exclusive of taxes, and are non-refundable except as required by law or expressly stated in the order form. You are responsible for any sales, use, VAT, GST, or withholding taxes that apply, other than taxes on our income.

Late payment. If undisputed fees are more than 30 days overdue we may suspend scanning after giving you at least 10 days' written notice.

5. Acceptable use

You agree not to, and not to allow others to:

• Use Vybscan to scan code, repositories, or data that you do not have the right to process.
• Use scan results to attack, exploit, or gain unauthorised access to any system, including systems owned by third parties.
• Reverse engineer, decompile, or attempt to extract the source code, detection rules, prompts, or models of the Service, except where law expressly permits.
• Resell, sublicense, or provide the Service to third parties as a service bureau, or use it to build a competing product.
• Circumvent scan limits, plan restrictions, rate limits, or security controls, or interfere with the Service's operation.
• Upload or cause the Service to process content that is unlawful, infringing, or that contains malware intended to harm the Service or Dheemai.
• Use the Service in violation of applicable law, including export control and sanctions law.

Security researchers who wish to test Vybscan itself should contact security@dheemai.com first. Good-faith research under our disclosure process is welcome; testing against other customers' data is not.

6. Your code and data

Ownership. You retain all rights to your source code, dependencies, configuration, and any other content that Vybscan accesses through GitHub ("Customer Content"). Dheemai claims no ownership of Customer Content.

Licence to us. You grant Dheemai a limited, non-exclusive, worldwide licence to access, copy, transmit, and process Customer Content solely to provide, secure, support, and improve the Service for you, and as otherwise permitted by our Privacy Policy.

No training on your code. We do not use Customer Content to train machine-learning models, and we contract with our AI provider on terms under which your content is not used to train that provider's models.

What we store. Vybscan stores organisation and repository identifiers, installation and scan metadata, your package inventory, findings and remediation details, and pull-request metadata. Source code is copied only for the duration of a scan and deleted when the scan finishes. Detailed data handling is described in the Privacy Policy and in the FAQ on the Vybscan product page.

Aggregated data. We may generate and use statistics that are aggregated and de-identified so that they do not identify you, your users, or your code, for example vulnerability prevalence across ecosystems.

7. AI-assisted analysis

Vybscan includes an optional code-review pass that uses a large language model hosted by a third-party provider. When this feature is enabled, selected source files and the context around candidate findings are sent to that provider for analysis. The provider's terms prohibit training on your content, and inputs are ordinarily deleted by the provider within 30 days.

You can disable AI-assisted analysis for your organisation at any time in the dashboard. All other scanners continue to run and no source code is sent to any AI provider while it is disabled.

8. Scan results and enforcement

No guarantee of completeness. No scanner finds every vulnerability. A clean result means Vybscan found nothing it recognised, not that your code is free of defects. Vybscan may also report findings that turn out not to be exploitable in your context.

Enforcement is your configuration. By default, findings are reported without blocking merges. If you enable block mode, Vybscan will fail the GitHub check for pull requests that meet the severity threshold you choose. You control that setting and may change it at any time. Dheemai is not responsible for merges that are blocked or allowed as a result of your configuration.

Fix pull requests. Where enabled, Vybscan may open a pull request proposing a dependency version change. It never merges anything. You are responsible for reviewing and testing any proposed change before merging it.

9. Privacy and security

Our collection and use of personal data is described in the Dheemai Privacy Policy, which forms part of these Terms. Our security programme, sub-processors, and compliance status are described in the Trust Center.

The Service runs on Google Cloud, with AI inference on Amazon Web Services. Hosting is configurable per customer: paid customers may choose the cloud region in which their data is stored and processed, subject to provider availability, and the chosen region will be recorded in the order form. Customer-VPC and on-premise deployment options are described in the Trust Center. Data may be processed in a region other than your own; if you are established in the European Economic Area, United Kingdom, or Switzerland, Standard Contractual Clauses are available on request. A data processing agreement is available for paid customers.

We will notify you without undue delay if we become aware of a security incident affecting your Customer Content, and will provide the information reasonably needed for you to meet your own notification obligations.

10. Intellectual property

The Service, including its software, detection rules, prompts, models, reports, documentation, and branding, is owned by Dheemai and its licensors and is protected by intellectual property law. Subject to these Terms, Dheemai grants you a limited, non-exclusive, non-transferable right to use the Service during your subscription for your internal business purposes.

Reports, findings, and remediation text generated for your repositories may be used by you for any internal purpose, including sharing with auditors and customers.

If you send us suggestions or feedback about the Service, you grant Dheemai a perpetual, irrevocable, royalty-free licence to use it without obligation to you.

11. Third-party services and data

The Service depends on GitHub and draws on public vulnerability and package data, including OSV.dev, the GitHub Advisory Database, deps.dev, public package registries, the FIRST EPSS model, and the CISA Known Exploited Vulnerabilities catalogue. These sources are provided by third parties under their own terms and licences, and Dheemai does not control their accuracy or availability. Attributions are listed in the product and available on request.

Dheemai is not responsible for GitHub outages, API changes, or rate limits, or for the terms or conduct of third-party services you use with Vybscan.

12. Confidentiality

Each party will protect the other's non-public information that is marked confidential or that a reasonable person would treat as confidential, including Customer Content, pricing, and security details. Each party will use such information only to perform under these Terms, will protect it with at least reasonable care, and will disclose it only to personnel and contractors who need it and are bound by comparable obligations. These duties do not apply to information that is public through no fault of the recipient, already known to the recipient, independently developed, or that must be disclosed by law after reasonable notice where permitted.

13. Warranties and disclaimers

Dheemai warrants that it will provide the Service with reasonable skill and care and substantially in accordance with its documentation. Your sole remedy for breach of this warranty is for Dheemai to correct the non-conformity or, if it cannot, to terminate the affected subscription and refund any prepaid fees for the unused period.

EXCEPT AS EXPRESSLY STATED IN THESE TERMS, THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". DHEEMAI DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICE WILL DETECT ALL VULNERABILITIES, BE ERROR-FREE, OR OPERATE WITHOUT INTERRUPTION. TRIAL USE IS PROVIDED WITHOUT ANY WARRANTY.

14. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, DHEEMAI'S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE FEES YOU PAID TO DHEEMAI FOR THE SERVICE IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR ONE HUNDRED US DOLLARS (US$100) IF YOU HAVE PAID NO FEES.

These limits do not apply to a party's indemnification obligations, breach of confidentiality, infringement of the other party's intellectual property, or liability that cannot be limited by law.

15. Indemnification

By Dheemai. Dheemai will defend you against any third-party claim that the Service, as provided by Dheemai and used in accordance with these Terms, infringes that third party's intellectual property rights, and will pay damages and costs finally awarded or agreed in settlement. This does not apply to claims arising from Customer Content, third-party data sources, or your combination or modification of the Service.

By you. You will defend Dheemai against any third-party claim arising from Customer Content, your breach of Section 5, or your use of scan results in violation of law, and will pay damages and costs finally awarded or agreed in settlement.

The indemnified party must give prompt notice of the claim, allow the indemnifying party to control the defence, and provide reasonable cooperation.

16. Term, suspension, and termination

These Terms apply from the moment you install or use Vybscan and continue until the Service is uninstalled from all of your GitHub accounts and any paid subscription has ended.

By you. You may stop using Vybscan at any time by uninstalling the GitHub App. Uninstalling stops all scanning immediately. Paid subscriptions end according to the order form.

By Dheemai. We may suspend or terminate your access if you materially breach these Terms and do not cure the breach within 15 days of notice, if your use creates a security or legal risk to the Service or other customers, or if required by law. We may also discontinue the trial or the Service with at least 30 days' notice, in which case any prepaid fees for the unused period will be refunded.

Effect. On termination your licence to the Service ends. We will delete Customer Content and stored findings for your organisation on request, and in any case in accordance with the retention periods in the Privacy Policy. Sections 6 (Your code and data, as to aggregated data), 10, 12, 13, 14, 15, 18, and 19 survive termination.

17. Changes to the Service and these terms

We improve the Service continuously and may add, change, or remove features, detection rules, and supported languages. We will not materially reduce the core functionality of a paid subscription during its term without notice.

We may update these Terms from time to time. Material changes will be announced in the dashboard or by email to the installation contact at least 30 days before they take effect. Continued use after the effective date is acceptance of the updated Terms. If you do not agree, uninstall Vybscan before that date.

18. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Before starting formal proceedings, each party agrees to raise the dispute in writing with the other and to negotiate in good faith for at least 30 days. Any dispute not resolved that way will be brought exclusively in the state or federal courts located in Delaware, and each party consents to their jurisdiction. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

19. General terms

• Entire agreement. These Terms, the Privacy Policy, and any order form are the entire agreement between the parties about the Service and replace all prior discussions.
• Assignment. Neither party may assign these Terms without the other's written consent, except to a successor in a merger, acquisition, or sale of substantially all assets, with notice.
• Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including failures of GitHub or cloud providers.
• Notices. Notices to Dheemai must be sent to contact@dheemai.com. Notices to you may be sent to the email address of the GitHub user who installed Vybscan or to the contact on your order form.
• Export. You will comply with applicable export control and sanctions laws and will not use the Service from a sanctioned jurisdiction.
• Severability and waiver. If any provision is unenforceable it will be modified to the minimum extent necessary and the rest remains in effect. A failure to enforce a provision is not a waiver.
• Independent parties. The parties are independent contractors. These Terms create no partnership, agency, or joint venture.
• Publicity. Dheemai may identify you as a customer by name and logo only with your prior written consent.

20. Contact