RepoPilot combines its own analysis with data from the sources below. Each source's data stays under its own licence and terms; using it through RepoPilot does not change them. See also our terms.
- GitHub Advisory Database (github.com/advisories): security advisories, licensed under CC BY 4.0. Advisory identifiers beginning GHSA- come from this database.
- OSV (osv.dev): vulnerability records aggregated from several databases. Each record remains under the licence of the database it came from; the record's source is shown on its osv.dev page.
- deps.dev / Open Source Insights (deps.dev): resolved dependency graphs, advisory links and package metadata. deps.dev's generated data is available under CC BY 4.0; use of its API is subject to the Google APIs Terms of Service.
- npm registry (npmjs.com): package metadata and published package files, used under the npm Open Source Terms. Package contents remain under their authors' licences.
- GitHub (github.com): public repository source, history, issues and releases, used under the GitHub Terms of Service. Source code remains under its owners' licences.
Advisory and dependency data change as sources publish and revise records. A result reflects the sources at the time it was computed and can be incomplete; see sections 2 and 3 of the terms.