Privacy policy

Last updated 31 October 2026

What OSSVulns is

OSSVulns is a hobby project that lists security-related changes in open-source projects. Its scanner reads the public commit history of the repositories it tracks and the GitHub notification emails those repositories send, and the website shows what matched.

If you appear in a finding

The feed is made of public activity on GitHub: commit messages in the repositories OSSVulns tracks, and the text of GitHub issue and pull request notifications from them. These can name the people who wrote or took part in them, by GitHub username or by name (in a commit's Signed-off-by line, for example). OSSVulns stores that text, the GitHub username of a notification's author and the author's role in the repository as GitHub reports it, and shows them on the website, in the API and in the RSS feeds, with a link to where they came from on GitHub.

This is done on the basis of legitimate interest (Article 6(1)(f) of the GDPR): letting the people who use open-source software know about security fixes and reports in it. Email addresses in the text aren't needed for that, so the website, the API and the RSS feeds leave them out. Findings are kept as part of the feed's history.

If you appear in a finding, you can ask for it to be corrected or removed, or object to it, by emailing contact@ossvulns.com. You can also complain to a data protection authority, such as the one in the country you live in.

If you only browse the feed

You don't need an account. The filters you pick are kept in your browser tab only and are gone when you close it. The site is hosted by Vercel, whose servers keep standard request logs (such as IP address and browser) for operating and securing the service.

If you sign in

Sign-in is handled by Auth0. OSSVulns receives your email address and an account ID from it, and stores a profile with your email address, the repositories you track, your alert settings and your saved feed filters. The profile is kept in a MongoDB Atlas database. A cookie keeps you signed in. This data is used only to run your account; it isn't sold, shared for advertising or used to profile you.

If you switch on alerts, they are emailed to the address you give, from alerts@ossvulns.com through Resend, an email delivery service that receives the address and the alert to deliver it, and posted to the Slack or Microsoft Teams webhook if you give one. Every alert email has an unsubscribe link.

If you upload dependency files on the My dependencies page, the list of packages and versions in them is stored with your profile (not the files themselves), and the package names are sent to Google's deps.dev service to find their source repositories. Repositories that OSSVulns doesn't track yet are added to its public feed.

API keys are stored only as a hash. Your personal RSS feed has a private link, which you can replace on the Settings page.

You can delete your account at any time under Settings → Delete Account, which removes your profile and your Auth0 login.

Gmail access (Google user data)

The scanner signs in with Google to a single Gmail inbox that exists only to receive GitHub notification emails for the tracked repositories. It doesn't access anyone else's Google account or any other inbox.

For each email in that inbox it reads the subject, date and text and checks them for security-related keywords. When something matches, it stores the subject, text, date, repository name and GitHub link, which are about public activity on GitHub, and shows them in the public feed. Every email it has read is then permanently deleted. The data is not sold, not used for advertising, and not shared with anyone except the services that host and run OSSVulns (MongoDB Atlas, Vercel, Anthropic as described below, and Resend, which delivers the alert emails).

OSSVulns' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI review

The text of each finding (a public commit message, or the text of a GitHub notification) is sent to Anthropic's Claude API, which judges whether it is a real security issue and writes a one-sentence summary that the feed shows. Under Anthropic's commercial terms, data sent to its API isn't used to train its models. No account data is sent.

Contact

For questions about this policy or your data, or anything else about OSSVulns, email contact@ossvulns.com. Cloudflare forwards it to the maintainer's mailbox.

Changes

If this policy changes, the date at the top of this page changes with it.