Terms of Service

1. The services

These terms cover (together, the “services”):

• flawharbor.com, our marketing website;
• the Flawharbor Cloud beta signup;
• cve.bz, our free public vulnerability database: its pages, public API, RSS and JSON feeds, MCP server and the “check your stack” tool.

Our Privacy Policy explains how we handle personal information on the services.

2. Flawharbor Cloud and the open-source code

Flawharbor Cloud (app.flawharbor.com), including any private beta of it, is governed by a separate agreement between Tarnover and the customer. If that agreement conflicts with these terms, that agreement controls.

The Flawharbor open-source software is licensed under its own license, found in its source repository. These terms do not limit the rights that license gives you, and they do not apply to copies of Flawharbor that others run. The operator of a self-hosted copy sets its own terms.

3. Acceptable use

You agree not to:

• use the services, or anything you learn from them, to attack, scan, exploit or gain access to any system, network or account you are not authorized to test;
• break any law, or infringe anyone’s rights, in using the services;
• disrupt, overload or impair the services, for example with traffic far beyond normal use;
• get around rate limits, blocks or other access controls, for example by rotating addresses or spreading requests across accounts or clients to exceed a limit;
• probe, scan or test the vulnerability of our own systems, except as we may allow in a published security policy;
• send malware or anything designed to harm the services or their users;
• submit false, misleading or someone else’s information on the signup form;
• suggest that Tarnover endorses or is affiliated with you or your product without our written permission.

We may limit, suspend or block access by anyone who breaks these terms or puts the services or other users at risk.

4. The public API, feeds and MCP server

cve.bz’s public API, feeds and MCP server are free and need no key. In return, please:

• respect the rate limits. When we answer that a limit has been reached (for example HTTP 429 with Retry-After, or an MCP error naming the seconds to wait), wait as asked before trying again;
• cache answers where you can; our answers say how long they may be cached;
• keep the attribution notices that come with the data when you republish it (see section 5).

We may change the API, the feeds, the MCP tools and the limits at any time, and may stop offering them.

5. Vulnerability data

The vulnerability data on cve.bz comes from third parties: the NIST National Vulnerability Database (NVD), the CVE Program’s CVE List, FIRST’s Exploit Prediction Scoring System (EPSS), the CISA Known Exploited Vulnerabilities catalog, and Open Source Vulnerabilities (OSV). We publish it as those sources publish it.

• Their terms apply. Each source’s data is subject to that source’s own terms and licenses. If you reuse the data, you are responsible for following them, including their attribution requirements. Their notices appear at the foot of every cve.bz page and in every API answer.
• No affiliation. cve.bz is not affiliated with, endorsed by or certified by the CVE Program, MITRE, NIST, the NVD, FIRST, CISA or OSV. CVE is a registered trademark of The MITRE Corporation. This product uses the NVD API but is not endorsed or certified by the NVD.
• No warranty. The data may be incomplete, delayed or wrong, and a source may change or withdraw a record. We do not check it independently and do not promise that it is accurate, complete or current.
• Not advice. Scores and listings are their sources’ assessments. They are not security, legal or other professional advice, and they cannot account for how a product or package is used in your environment. You are responsible for your own security decisions.

6. Files you check

When you check a lockfile or software bill of materials on cve.bz, through the page, the API or the MCP check_stack tool, you confirm that you have the right to submit it. We use the file only to answer your check: we read it in memory, match it, and discard it without storing it. You keep all rights in it. Do not submit files that contain secrets, such as credentials or private tokens.

7. The beta list

Joining the beta list signs you up for the updates you choose. It does not create an account or guarantee an invitation, a place in the beta, or any particular launch date. Invitations are at our discretion, and taking part in the beta is subject to the separate agreement described in section 2.

8. Intellectual property

The services’ own content, design, artwork and software, apart from the third-party data described in section 5 and the open-source code described in section 2, belong to Tarnover or its licensors. The Flawharbor and cve.bz names and logos are our trademarks. You may not use them in a way that suggests our endorsement, or that is likely to cause confusion, without our written permission. You may link to the services and quote them with attribution.

If you send us feedback or suggestions, we may use them without any obligation to you.

9. Other websites

The services link to websites we do not control, including the data sources and the references in vulnerability records. We are not responsible for their content, availability or practices, and a link is not an endorsement.

10. Availability and changes

We offer the services free of charge and without a service level. We may change, suspend or stop any part of them, at any time and without notice, and they may sometimes be unavailable. We may end or suspend your access if you break these terms.

11. Disclaimers

THE SERVICES AND ALL DATA ON THEM ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT AND ACCURACY. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, SECURE OR ERROR-FREE, OR THAT THE DATA IS ACCURATE, COMPLETE OR CURRENT. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES, SO SOME OF THESE EXCLUSIONS MAY NOT APPLY TO YOU.

12. Limitation of liability

TO THE FULLEST EXTENT THE LAW ALLOWS, TARNOVER AND ITS MEMBERS, MANAGERS, EMPLOYEES AND SUPPLIERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA OR GOODWILL, OR FOR ANY SECURITY INCIDENT, ARISING FROM OR RELATED TO THE SERVICES OR THE DATA ON THEM, EVEN IF ADVISED OF THEIR POSSIBILITY. OUR TOTAL LIABILITY FOR ALL CLAIMS RELATED TO THE SERVICES IS LIMITED TO ONE HUNDRED US DOLLARS (US$100). THESE LIMITS APPLY WHATEVER THE LEGAL THEORY OF THE CLAIM, AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE. SOME JURISDICTIONS DO NOT ALLOW THESE LIMITS, SO THEY MAY NOT ALL APPLY TO YOU.

13. Indemnity

To the extent the law allows, you will defend, indemnify and hold harmless Tarnover and its members, managers and employees from claims, losses and costs, including reasonable attorneys’ fees, that arise from your misuse of the services, your breach of these terms, or your violation of any law or anyone’s rights.

14. Governing law and venue

These terms are governed by the laws of the State of California, USA, without regard to its conflict of laws rules. Any dispute arising from or related to these terms or the services will be brought only in the state and federal courts located in California, and you and we consent to their personal jurisdiction. Either party may still seek an injunction in any competent court to protect its intellectual property or the security of the services.

15. Changes to these terms

We may update these terms. We will post the new version here and change the “Last updated” date. Changes apply from the time they are posted, except that a change does not apply to a dispute that arose before it. If you keep using the services after a change, you accept the new terms.

16. General

These terms, with the Privacy Policy, are the entire agreement between you and us about the services, apart from any separate agreement described in section 2. If a provision is found unenforceable, the rest stays in effect. Our not enforcing a provision is not a waiver of it. You may not assign these terms without our consent; we may assign them in connection with a merger, acquisition or sale of assets. Sections 5, 8 and 11 through 16 survive the end of your use of the services.