Terms of use

Last updated 31 October 2026

What OSSVulns is

OSSVulns is a free hobby project that lists security-related changes it finds in public open-source activity on GitHub. By using the website, its API, RSS feeds or alerts you agree to these terms.

No guarantees

Everything is provided as is. Findings come from keyword matching and from an AI review of the text alone, and can be wrong, incomplete or late: a finding isn't proof of a vulnerability, and the absence of one isn't proof that a project is safe. Check the source and the project's own advisories before acting on a finding. The service can change, pause or stop at any time.

Liability

As far as the law allows, OSSVulns and the person who runs it aren't liable for any loss or damage that comes from using the website, the API, the RSS feeds or the alerts, or from relying on them.

Content from GitHub

Commit messages, comments and names belong to the people who wrote them. They're shown as found, with a link to where they came from, and OSSVulns doesn't vouch for them. Anyone can comment on an open-source project, so a finding's text can be misleading: don't run commands or install software it suggests without checking them.

The API and the feeds

Keep your API keys and your personal RSS link to yourself. Each key can make 1,000 requests a day. Keys used to overload or misuse the service can be revoked. Don't use the data to contact, profile or harass the people named in it.

Your account

You can delete your account at any time under Settings → Delete Account. How your data is handled is described in the privacy policy.

Contact

To ask for a finding to be corrected or removed, or about anything else, email contact@ossvulns.com.

Changes

If these terms change, the date at the top of this page changes with it.