vulncheck
6740b44edb
Publishing under AGPL without a CLA closes the door on ever offering
commercial terms: every merged PR would be copyright we cannot relicense,
and asking dozens of contributors for permission after the fact does not
work. CLA.md section 2 grants the maintainer a license "under any license
terms, including proprietary" — that clause is the whole point.
LICENSING.md states the open-core boundary up front rather than carving
features out later, which is the move that has burned trust elsewhere. The
entire detection and enrichment engine stays AGPL; Enterprise is limited to
SSO, audit trail, compliance reporting, SIEM forwarding and multi-tenancy,
under a stated two-part rule for what may ever go there.
SECURITY.md gives a private disclosure path — a vulnerability scanner whose
own bugs land as public issues is a poor advertisement.
The CLA bot runs as a GitHub Action writing signatures to a cla-signatures
branch, so there is no third-party service to sign up for.
Placeholders {{LICENSOR}}, {{CONTACT}}, {{GH_OWNER}} and {{GH_REPO}} are
filled in once the legal entity and the GitHub location are settled.
5.1 KiB
Licensing
TrueVuln is open core. This document is the authoritative statement of what is free and open source software and what is not. It is published alongside the first public release so the boundary is known up front and does not move under you.
Copyright (C) 2026 {{LICENSOR}}
The short version
| Everything in this repository | Free and open source under AGPL-3.0-or-later. Self-host it, modify it, run it in production, commercially, at no cost. |
| TrueVuln Enterprise | A separate, commercially licensed add-on. Not in this repository. Not required to run TrueVuln. |
There is no "crippled community edition". The entire detection and enrichment engine -- the part that actually does the work -- is AGPL and stays AGPL.
What is AGPL-3.0 (this repository)
The complete, production-usable vulnerability management platform:
Scanner and inventory integrations
- Wazuh (agent discovery, vulnerability sync, Syscollector triggers, patch verification)
- Tenable Nessus (scan import, launch/poll, VPR, exploit maturity)
- Microsoft Intune / Graph API (managed devices, detectedApps)
- Microsoft Defender for Endpoint TVM (per-device CVEs, software inventory)
- VMware vCenter / ESXi
Threat-intelligence enrichment
- EPSS, CISA KEV, ENISA EUVD
- Exploit-DB, PoC-in-GitHub, Metasploit module index
- cvelistV5, CISA Vulnrichment, NVD, GitHub Advisories (GHSA)
- Mozilla MFSA, MSRC, Ubuntu USN, Red Hat errata, OSV.dev
Detection engines
- End-of-life / end-of-support detection (endoflife.date + Microsoft product lifecycle)
- Microsoft 365 Apps CVE detection
- Windows OS CVE detection (client and server, build-range matched)
- SharePoint and modern .NET detection
- MSRC fixed-build scanning
- Mobile device security (Samsung SMR, Google ASB, Android patch-level staleness)
- App-to-CVE scanner for software with no dedicated scanner
- Security advisory feeds (CISA KEV, RSS sources)
Platform
- Priority and CPR risk scoring, SLA tracking and enforcement, email alerts
- Automated patch verification, deferral and false-positive workflows
- Full web UI and dashboard
- Local authentication with TOTP multi-factor authentication
- Role-based access control
- REST API
- CSV export
This is a complete product. A company can run it, rely on it, and never pay anything.
What is TrueVuln Enterprise (commercial)
Distributed separately under a commercial license, aimed at organisations with a regulatory driver and a compliance budget:
| Capability | Why it is here |
|---|---|
| Enterprise SSO -- LDAP / Active Directory, OIDC, SAML with JIT provisioning and role mapping | Needed only once identity is centrally governed |
| Revision-proof audit trail -- tamper-evident, exportable, retention-managed | Driven by audit and certification requirements |
| Compliance reporting -- PCI-DSS, ISO 27001, NIST 800-53, HIPAA control mapping, scoped PDF reports | Produced for auditors, not for operators |
| SIEM forwarding -- syslog / CEF export to external SIEM | Enterprise integration surface |
| Multi-tenancy -- mandant separation for MSPs and holding structures | Only meaningful above single-organisation scale |
| Priority support with SLA | Commercial obligation, not code |
The rule we hold ourselves to
A feature belongs in Enterprise only if both are true:
- It is not needed to detect, prioritise, or remediate a vulnerability.
- The organisations that need it have a compliance or scale driver, and therefore a budget.
Anything that makes TrueVuln better at its actual job -- finding real vulnerabilities on real assets -- goes into the AGPL core. We will not move an existing AGPL feature into Enterprise. New Enterprise features are additive.
Why AGPL-3.0
AGPL is a strong copyleft licence with a network clause. Anyone who modifies TrueVuln and offers it to third parties over a network must publish their modifications.
For you as a user, this means nothing changes: self-hosting TrueVuln inside your own organisation, including commercially, triggers no obligation to publish anything. The network clause applies to offering the software as a service to others.
For us, it means a cloud provider cannot take this work, run it as a paid service, and give nothing back.
Commercial licence exemption
If AGPL-3.0 is incompatible with your intended use -- typically because you want to embed TrueVuln in a proprietary product or offer it as a hosted service without publishing your modifications -- a commercial licence is available. Contact: {{CONTACT}}
Contributing
Contributions to this repository are accepted under the Contributor License Agreement. The CLA lets us offer TrueVuln under both AGPL and commercial terms. You keep the copyright to your work. See CONTRIBUTING.md.
Trademark
"TrueVuln" and the TrueVuln logo are trademarks of {{LICENSOR}}. The AGPL grants rights to the code, not to the name. You may state that your product is built on or derived from TrueVuln. You may not use the name or logo in a way that suggests your fork is the official distribution.
SPDX
SPDX-License-Identifier: AGPL-3.0-or-later