# Licensing TrueVuln is **open core**. This document is the authoritative statement of what is free and open source software and what is not. It is published alongside the first public release so the boundary is known up front and does not move under you. Copyright (C) 2026 {{LICENSOR}} ## The short version | | | |---|---| | **Everything in this repository** | Free and open source under **AGPL-3.0-or-later**. Self-host it, modify it, run it in production, commercially, at no cost. | | **TrueVuln Enterprise** | A separate, commercially licensed add-on. Not in this repository. Not required to run TrueVuln. | There is no "crippled community edition". The entire detection and enrichment engine -- the part that actually does the work -- is AGPL and stays AGPL. ## What is AGPL-3.0 (this repository) The complete, production-usable vulnerability management platform: **Scanner and inventory integrations** - Wazuh (agent discovery, vulnerability sync, Syscollector triggers, patch verification) - Tenable Nessus (scan import, launch/poll, VPR, exploit maturity) - Microsoft Intune / Graph API (managed devices, detectedApps) - Microsoft Defender for Endpoint TVM (per-device CVEs, software inventory) - VMware vCenter / ESXi **Threat-intelligence enrichment** - EPSS, CISA KEV, ENISA EUVD, VulnCheck KEV (community, optional) - Exploit-DB, PoC-in-GitHub, Metasploit module index - cvelistV5, CISA Vulnrichment, NVD, GitHub Advisories (GHSA) - Mozilla MFSA, MSRC, Ubuntu USN, Red Hat errata, OSV.dev **Detection engines** - End-of-life / end-of-support detection (endoflife.date + Microsoft product lifecycle) - Microsoft 365 Apps CVE detection - Windows OS CVE detection (client and server, build-range matched) - SharePoint and modern .NET detection - MSRC fixed-build scanning - Mobile device security (Samsung SMR, Google ASB, Android patch-level staleness) - App-to-CVE scanner for software with no dedicated scanner - Security advisory feeds (CISA KEV, RSS sources) **Platform** - Priority and CPR risk scoring, SLA tracking and enforcement, email alerts - Automated patch verification, deferral and false-positive workflows - Full web UI and dashboard - Local authentication with TOTP multi-factor authentication - Role-based access control - REST API - CSV export This is a complete product. A company can run it, rely on it, and never pay anything. ## What is TrueVuln Enterprise (commercial) Distributed separately under a commercial license, aimed at organisations with a regulatory driver and a compliance budget: | Capability | Why it is here | |---|---| | **Enterprise SSO** -- LDAP / Active Directory, OIDC, SAML with JIT provisioning and role mapping | Needed only once identity is centrally governed | | **Revision-proof audit trail** -- tamper-evident, exportable, retention-managed | Driven by audit and certification requirements | | **Compliance reporting** -- PCI-DSS, ISO 27001, NIST 800-53, HIPAA control mapping, scoped PDF reports | Produced for auditors, not for operators | | **SIEM forwarding** -- syslog / CEF export to external SIEM | Enterprise integration surface | | **Multi-tenancy** -- mandant separation for MSPs and holding structures | Only meaningful above single-organisation scale | | **Priority support with SLA** | Commercial obligation, not code | ### The rule we hold ourselves to A feature belongs in Enterprise only if **both** are true: 1. It is not needed to detect, prioritise, or remediate a vulnerability. 2. The organisations that need it have a compliance or scale driver, and therefore a budget. Anything that makes TrueVuln better at its actual job -- finding real vulnerabilities on real assets -- goes into the AGPL core. We will not move an existing AGPL feature into Enterprise. New Enterprise features are additive. ## Why AGPL-3.0 AGPL is a strong copyleft licence with a network clause. Anyone who modifies TrueVuln and offers it to third parties over a network must publish their modifications. For you as a user, this means nothing changes: **self-hosting TrueVuln inside your own organisation, including commercially, triggers no obligation to publish anything.** The network clause applies to offering the software as a service to others. For us, it means a cloud provider cannot take this work, run it as a paid service, and give nothing back. ## Commercial licence exemption If AGPL-3.0 is incompatible with your intended use -- typically because you want to embed TrueVuln in a proprietary product or offer it as a hosted service without publishing your modifications -- a commercial licence is available. Contact: {{CONTACT}} ## Contributing Contributions to this repository are accepted under the [Contributor License Agreement](CLA.md). The CLA lets us offer TrueVuln under both AGPL and commercial terms. You keep the copyright to your work. See [CONTRIBUTING.md](CONTRIBUTING.md). ## Trademark "TrueVuln" and the TrueVuln logo are trademarks of {{LICENSOR}}. The AGPL grants rights to the *code*, not to the name. You may state that your product is built on or derived from TrueVuln. You may not use the name or logo in a way that suggests your fork is the official distribution. ## SPDX SPDX-License-Identifier: AGPL-3.0-or-later ## Data source attribution **VulnCheck KEV** — when the VulnCheck KEV source is enabled (optional, off without `VULNCHECK_API_TOKEN`), its data is free to use in commercial and open-source products on one condition: prominent attribution. The Advisories page therefore names "VulnCheck KEV" in the KEV panel header and badges every row the source contributed to. Do not remove that labelling while the source is enabled — it is the licence term, not decoration.