These Terms govern your use of Cefense, the platform that scans your repositories, joins each finding to the public security research that explains it, writes a patch, and opens a pull request.
Effective
September 13, 2026
Last updated
September 13, 2026
Entity
Cefense, Inc.
You authorize every scan
You may only connect repositories you own or are permitted to scan, and you are responsible for that permission.
We open pull requests, you merge them
A proposed fix is a proposal. Nothing reaches your default branch without a human on your side approving it.
Scans pause, they do not overbill
When an allowance runs out, scanning stops. We do not meter you past the plan you bought.
Seven days to change your mind
Contact support@email.cefense.com within seven days of a charge and we will make it right, with a reply inside five business days.
These Terms of Service (the "Terms") are a binding contract between you and Cefense, Inc., a corporation based in the State of Utah ("Cefense", "we", "us", or "our"). They govern your access to and use of the Cefense website, workspace, command line interface, application programming interfaces, and related services (together, the "Service").
By creating an account, connecting a repository, running a scan, or otherwise using the Service, you accept these Terms. If you do not accept them, do not use the Service.
If you accept these Terms on behalf of a company, organization, or other legal entity, you represent that you have the authority to bind that entity, and "you" means that entity. If you do not have that authority, you may not accept these Terms or use the Service on its behalf.
You must be at least 18 years old and legally capable of entering into a contract to use the Service.
The account container that owns a plan, an Allowance, connected repositories, seats, and scan history. Billing, entitlements, and data ownership all attach to the Organization, not to an individual user.
Seat
A user authorized to access an Organization. Seats grant access; they do not divide the Allowance, which is pooled across the Organization.
Code Host
A third-party source control service you connect to the Service, including GitHub, GitLab, and Bitbucket.
Customer Content
Everything you or your Code Host supplies to the Service or the Service retrieves on your instruction, including source code, commit history, branch and pull request metadata, dependency manifests, configuration, and anything else present in a connected repository.
Output
Everything the Service produces from Customer Content, including findings, severity assessments, intelligence matches, citations, proposed patches, pull requests, software bills of materials, proofs, and reports.
Corpus
The indexed body of publicly available security research the Service maintains and matches findings against.
Token
The unit in which the Service meters model usage, counted as prompt, cached prompt, and completion tokens summed across every model call attributable to your Organization.
Allowance
The quantity of Tokens granted to your Organization for a billing month under its plan.
The Service continuously indexes publicly available security research, scans repositories you connect, links findings in your code to the research that describes the underlying technique, proposes a change that closes the finding, and produces evidence that the change holds. The workflow is organized in four stages: Reproduced, Matched, Fix, and Proof.
You may reach the Service through the web workspace, through the cf command line interface, or through a coding agent using our documented agent interface. All three are the Service and all three are governed by these Terms.
We may add, change, suspend, or remove features at any time. If we discontinue a material feature of a paid plan, your sole remedy is described in section 26.
You must register an account to use the Service. You are responsible for the accuracy of your registration information, for the security of your credentials, and for all activity that occurs under your account or within your Organization, whether or not you authorized it.
Creating an Organization is free. An Organization may add seats up to the number included in its plan and may purchase additional seats as described on our pricing page. You are responsible for who you admit to your Organization, and any person you admit may be able to read Customer Content, Output, and findings belonging to that Organization.
Notify us at support@email.cefense.com immediately if you learn of any unauthorized access to your account or Organization.
To scan a repository you must authorize the Service to access it through your Code Host, using that host's own installation or authorization flow. That authorization is what permits us to read your repositories, and it is what permits us to write to them.
What that authorization allows
Reading. The Service reads repository contents, commit history, branch state, pull request metadata, and dependency manifests in order to scan.
Writing. Where you have granted write access and enabled the feature, the Service creates branches and opens pull requests containing proposed fixes. The Service does not push to your default branch and does not merge a pull request.
Webhooks. The Service may register webhooks so that pushes and pull requests trigger scans.
You may revoke our access at any time through your Code Host or through the workspace. Revocation stops future scanning. It does not by itself delete data we already hold; see the Privacy Policy for retention and deletion.
Your use of a Code Host is governed by that host's own terms. We are not responsible for a Code Host's availability, its rate limits, or its acts and omissions.
Security scanning is a sensitive activity. You represent and warrant, for every repository you connect and every scan you run, that you own the code or have the documented authorization of its owner to submit it for automated security analysis, to have derivative patches generated from it, and to have pull requests opened against it.
You are solely responsible for obtaining that authorization. You may not use the Service to scan, analyze, or generate findings against code you do not own or are not permitted to test, and you may not use the Service to develop or refine an exploit against a system you are not authorized to test.
Where a connected repository contains third-party or open source code, you are responsible for ensuring that your use of the Service is consistent with the licenses that govern it.
Customer Content is yours. As between you and us, you retain all right, title, and interest in Customer Content, including all intellectual property rights in it. We claim no ownership of your code.
You grant us a limited, non-exclusive, worldwide, royalty-free license to host, copy, transmit, display, analyze, and create derivative works of Customer Content solely to operate the Service for you: to scan your repositories, to generate Output, to open pull requests you have authorized, to maintain security and backups, to prevent abuse, and to provide support you request. This license exists to run the Service and for nothing else. It ends when the content is deleted, subject to the retention periods in the Privacy Policy.
Output belongs to you. As between you and us, you own the Output generated from your Customer Content, including proposed patches, and you may use it without restriction. We retain ownership of the Service, the Corpus, our rulepacks, our detection logic, and any statistical or aggregated data that does not identify you or your code and cannot reasonably be used to reconstruct it.
Because Output is produced by machine learning systems that receive similar inputs from many customers, Output may be similar or identical to output generated for another customer. We make no representation that Output is unique to you.
The Service may fail to detect vulnerabilities present in your code, including severe ones, and a clean scan is not a certification, an attestation, or a warranty that a repository is free of vulnerabilities.
Findings, severities, and intelligence matches are assessments, not verdicts, and may be incorrect, incomplete, or misapplied to your context.
Proposed patches may be wrong, may fail to close the finding they address, may break functionality, may introduce new defects, and must be reviewed and tested by a qualified person before use.
A proof or verification result indicates that a specific check passed against a specific revision. It is not a general assertion of security.
Citations to public research are provided for context. We do not control that research and do not warrant its accuracy.
The Service is not legal, regulatory, or compliance advice, and does not by itself establish compliance with any standard, framework, or law.
You are responsible for reviewing Output and for every decision you make on the basis of it.
Current plans, prices, included seats, and Allowances are published at cefense.com/pricing and are incorporated into these Terms by reference. The following rules govern how billing works regardless of the numbers in effect.
How you are charged
We bill per Organization, not per developer. Subscription fees are charged in advance, monthly or annually depending on the term you select, and renew automatically until cancelled.
Annual plans are billed once for the year at the discounted rate published on the pricing page.
Additional seats are charged at the published rate and are prorated to your current billing period when added.
All fees are stated and payable in United States dollars.
Fees are exclusive of taxes. You are responsible for all sales, use, value added, and similar taxes, excluding taxes on our net income.
How the Allowance works
The Allowance is pooled across the Organization. Seats add capacity to the pool; they do not carve it into per-user shares.
The Allowance is granted each month, including on annual plans. An annual subscriber receives twelve monthly grants rather than a single pool on day one.
Unused Allowance rolls over for one month and then expires. Rollover is capped at one month of your plan's Allowance and carries no cash value.
When the Allowance is exhausted, scanning pauses. We do not meter you past your plan. There is no automatic overage billing, and you will not receive an invoice you did not agree to. Scanning resumes at the next monthly grant, or when you upgrade.
Failed scans do not consume your Allowance. If a scan errors before producing findings, we absorb the cost.
Token counts and their recorded cost are frozen when written. Changing a published rate never reprices your history.
Payment
Payments are processed by Stripe, Inc. We do not receive or store your full card number. You authorize us and our payment processor to charge your payment method for all fees when due. If a charge fails, we may retry it and may suspend the Service until payment succeeds.
We may change prices. For monthly plans a price change takes effect at your next renewal. For annual plans it takes effect at the start of your next annual term. We will give you at least 30 days' notice before a price increase applies to you, and you may cancel before it takes effect.
Creating an Organization is free and always will be. A new Organization receives a one-time Allowance that does not expire. It is a grant, not a trial: nothing is taken away on a date, the grant is simply spent.
The free grant is limited to one per Organization and one per verified billing email address, and the connecting Code Host account must have existed for at least 90 days. You may not create multiple accounts, Organizations, or Code Host accounts to obtain more than one grant. We may withhold, reduce, or revoke a grant, and may suspend the accounts involved, where we reasonably determine this section has been circumvented.
Free Organizations are provided as-is, may be rate limited, and may be changed or discontinued at any time.
You may cancel at any time from the workspace. Cancellation stops future renewals. Your plan remains active, with its entitlements, until the end of the period you have already paid for.
Outside that seven day window, fees are non-refundable and we do not prorate partial periods, except where a refund is required by law or where we terminate your account without cause under section 20.
Unused Allowance has no cash value and is not refundable in any circumstance.
Use the Service to scan, probe, or analyze code or systems you do not own and are not authorized to test.
Use the Service, or Output from it, to develop, refine, weaponize, or distribute an exploit or malware against a system you are not authorized to test, or to facilitate unauthorized access to anyone's systems.
Upload or submit content that is unlawful, that infringes another party's rights, or that you are prohibited from disclosing.
Reverse engineer, decompile, or attempt to derive the source code, rulepacks, prompts, or detection logic of the Service, except to the extent this restriction is unenforceable under applicable law.
Use the Service to build, train, or benchmark a competing security analysis product, or to extract the Corpus in bulk.
Resell, sublicense, or provide the Service to a third party as a service bureau, except under a written agreement with us.
Circumvent, disable, or interfere with Allowance metering, entitlement checks, rate limits, or any other technical restriction.
Interfere with or disrupt the integrity or performance of the Service, or attempt to gain unauthorized access to it or to another customer's data.
Use automated means to access the Service in a manner that imposes an unreasonable load, other than through our documented interfaces.
Violate any applicable law, including export control, sanctions, and computer misuse laws.
If you believe you have found a vulnerability in the Service itself, report it to support@email.cefense.com rather than exploiting it. We will not pursue good faith security research conducted in accordance with that report.
The Service indexes publicly available security research and presents summaries of and citations to it. That research is the work of its original publishers. We do not claim ownership of it, and summaries and excerpts are provided for the purpose of identifying and explaining the technique behind a finding.
We do not warrant that any research in the Corpus is accurate, current, or applicable to your systems. Where the Service links to an external source, that source is governed by its own terms.
If you are a publisher and believe material in the Corpus should be removed or attributed differently, contact support@email.cefense.com and we will act promptly.
The Service, including its software, interfaces, detection logic, rulepacks, prompts, models, the Corpus as a compiled work, documentation, and the Cefense name and marks, is owned by us and our licensors and is protected by intellectual property law.
Subject to these Terms and to payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable right to access and use the Service during your subscription term for your internal business purposes. Any rights not expressly granted are reserved.
Our command line interface and any other component we distribute under an open source license is governed by that license to the extent it conflicts with this section.
If you send us suggestions, bug reports, or ideas about the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free license to use them without restriction or compensation. We will not identify you as the source without your permission. Please do not include confidential information in feedback.
Each party may receive information of the other that is marked confidential or that a reasonable person would understand to be confidential. Customer Content is your Confidential Information. The non-public elements of the Service, including detection logic, rulepacks, and pricing offered under a negotiated agreement, are our Confidential Information.
Each party will protect the other's Confidential Information with at least reasonable care, will use it only to perform under these Terms, and will disclose it only to employees, contractors, and subprocessors who need it and who are bound by confidentiality obligations at least as protective as these. This does not apply to information that is or becomes public through no fault of the receiving party, was already known to it without restriction, or is independently developed by it.
A party may disclose Confidential Information where legally compelled, provided it gives the other party prompt notice where lawful to do so and reasonable assistance in seeking protective treatment.
We maintain administrative, technical, and physical safeguards designed to protect Customer Content against unauthorized access, loss, and disclosure, including encryption of credentials at rest, encryption in transit, scoped database roles, and access controls limiting internal access to what is necessary to operate and support the Service.
No system is perfectly secure. We do not warrant that the Service or Customer Content will be free from unauthorized access. You are responsible for the security practices on your side, including the scope of the access you grant your Code Host, who you admit to your Organization, and the secrets you leave in your repositories.
If we become aware of a security incident affecting Customer Content, we will notify the affected Organization without undue delay and describe what we know and what we are doing about it.
The Service depends on third parties, including your Code Host, our cloud infrastructure providers, our payment processor, and the artificial intelligence model providers that perform inference on Customer Content. Those providers are identified in the Privacy Policy.
We are responsible for our subprocessors' performance of our obligations under these Terms. We are not responsible for the availability, acts, or omissions of a third-party service you connect yourself, and your use of any such service is governed by its own terms.
We may offer features labelled beta, preview, experimental, or similar. They are provided as-is and as-available, without any warranty, may be changed or withdrawn at any time, and may not be covered by any service commitment. Do not rely on a beta feature for anything you cannot afford to lose.
You may stop using the Service and delete your Organization at any time.
We may suspend or terminate your access, in whole or in part, if you materially breach these Terms, if your payment fails and is not cured within 10 days of notice, if we are required to do so by law, or if your use poses a security, legal, or operational risk to us or to another customer. Where practical and lawful we will give you notice and an opportunity to cure first. Where a suspension is necessary to prevent imminent harm, we may act immediately and notify you promptly after.
We may terminate a free Organization for any reason on notice.
On termination, your right to use the Service ends, scanning stops, and we will delete or de-identify Customer Content in accordance with the retention schedule in the Privacy Policy. You may export your data at any time before termination, and for 30 days after, by request. If we terminate a paid Organization without cause, we will refund the unused portion of any prepaid fees on a prorated basis.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICE AND ALL OUTPUT ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND. WE DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED, AND STATUTORY, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.
WITHOUT LIMITING THE FOREGOING, WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, TIMELY, OR ERROR FREE, THAT IT WILL DETECT ANY OR ALL VULNERABILITIES IN YOUR CODE, THAT ANY FINDING IS ACCURATE OR EXPLOITABLE, THAT ANY PROPOSED FIX WILL BE CORRECT, COMPLETE, OR SAFE TO MERGE, OR THAT USE OF THE SERVICE WILL MAKE YOUR SOFTWARE SECURE OR COMPLIANT WITH ANY STANDARD OR LAW.
Some jurisdictions do not allow the exclusion of certain warranties, so some of these exclusions may not apply to you.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE, WHETHER IN CONTRACT, TORT, OR ANY OTHER THEORY, AND WHETHER OR NOT THE PARTY WAS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID US FOR THE SERVICE IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, AND (B) ONE HUNDRED UNITED STATES DOLLARS.
IN PARTICULAR, AND WITHOUT LIMITING THE ABOVE, WE ARE NOT LIABLE FOR ANY SECURITY INCIDENT, BREACH, LOSS, OR DAMAGE ARISING FROM A VULNERABILITY THE SERVICE DID NOT DETECT, FROM A FINDING THAT WAS INACCURATE, OR FROM A PROPOSED FIX THAT YOU MERGED.
These limitations do not apply to your payment obligations, to either party's indemnification obligations, to your breach of section 6 or section 12, or to liability that cannot be limited by law, including for fraud, gross negligence, or wilful misconduct. Some jurisdictions do not allow certain limitations, so some of these may not apply to you.
These limitations apply even if a limited remedy fails of its essential purpose, and they reflect an agreed allocation of risk that is a basis of the pricing of the Service.
By you. You will defend, indemnify, and hold us harmless from any third-party claim, and any resulting loss, liability, damage, cost, and reasonable attorneys' fees, arising out of or relating to: (a) Customer Content; (b) your breach of section 6, including any claim that you were not authorized to submit a repository for scanning or to have pull requests opened against it; (c) your breach of section 12; or (d) your violation of law or of a third party's rights.
By us. We will defend, indemnify, and hold you harmless from any third-party claim that the Service, used in accordance with these Terms, infringes that party's United States patent, copyright, or trademark, and will pay amounts finally awarded or agreed in settlement. This obligation does not apply to a claim arising from Customer Content, from Output, from your combination of the Service with anything we did not supply, or from your use of the Service in breach of these Terms. If the Service becomes, or we believe it may become, the subject of such a claim, we may procure the right to continue using it, modify it, or terminate the affected subscription and refund prepaid unused fees.
The indemnified party must give prompt notice, allow the indemnifying party to control the defense, and provide reasonable cooperation. No settlement that imposes an obligation on the indemnified party may be made without its consent.
Before filing a claim, you agree to try to resolve it with us informally by sending a written description of the dispute and the relief you seek to support@email.cefense.com. We will do the same. If the dispute is not resolved within 60 days, either party may proceed to arbitration. This step is a condition precedent to arbitration, and the limitations period is tolled while it runs.
Binding individual arbitration
Except as set out below, any dispute, claim, or controversy arising out of or relating to these Terms or the Service will be resolved by binding individual arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, rather than in court. The arbitration will be seated in Salt Lake County, Utah, or conducted by videoconference or on documents alone where the AAA rules permit. The arbitrator's award may be entered in any court of competent jurisdiction. The Federal Arbitration Act governs the interpretation and enforcement of this section.
Class action waiver
YOU AND CEFENSE EACH AGREE THAT CLAIMS MAY BE BROUGHT ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, CONSOLIDATED, OR REPRESENTATIVE PROCEEDING. The arbitrator may not consolidate more than one person's claims and may not preside over any form of representative proceeding. If this paragraph is found unenforceable as to a particular claim, that claim, and only that claim, will be severed and brought in court, and the remainder of this section will continue to apply.
Exceptions
Either party may bring an individual claim in small claims court if it qualifies.
Either party may seek injunctive or other equitable relief in court to protect its intellectual property or Confidential Information, without waiving this section.
Nothing here prevents either party from reporting a matter to a government agency.
Your right to opt out
You may opt out of this arbitration and class action waiver section by sending written notice to support@email.cefense.com with the subject line "Arbitration Opt-Out", within 30 days of first accepting these Terms, stating your name, your Organization, and your intent to opt out. Opting out does not affect any other part of these Terms, and we will not retaliate for it. If you opt out, section 25 governs.
These Terms are governed by the laws of the State of Utah, without regard to its conflict of laws rules, and by the federal laws of the United States. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
For any dispute not subject to arbitration under section 24, you and we consent to the exclusive jurisdiction and venue of the state and federal courts located in Salt Lake County, Utah, and each party waives any objection to that venue and, to the extent permitted by law, any right to a jury trial.
We may update these Terms. If a change is material, we will give at least 30 days' notice by email to the address on your Organization or by a notice in the workspace before it takes effect, and we will update the date at the top of this page. Changes apply prospectively.
If you do not agree to a change, your remedy is to stop using the Service and cancel before the change takes effect. If you cancel a paid plan for this reason, we will refund the unused portion of any prepaid fees on a prorated basis. Continued use after a change takes effect means you accept it.
If we discontinue a material feature of a paid plan during a term you have prepaid, you may cancel and receive a prorated refund of the unused portion.
These Terms, together with the Privacy Policy and any order form or written agreement signed by both parties, are the entire agreement between us about the Service and supersede all prior discussions. A conflicting term in a purchase order or vendor portal has no effect unless we sign it.
Order of precedence
Where a signed order form or enterprise agreement conflicts with these Terms, that document controls for the Organization it covers.
Assignment
You may not assign these Terms without our written consent, except to a successor in a merger or sale of substantially all your assets, provided the successor is not a competitor of ours. We may assign these Terms to an affiliate or in connection with a merger, acquisition, or sale of assets. Any other attempted assignment is void.
No waiver
A failure to enforce a provision is not a waiver of it.
Severability
If a provision is held unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions stay in force.
Force majeure
Neither party is liable for a delay or failure caused by events beyond its reasonable control, including acts of God, war, terrorism, labour disputes, governmental action, internet or utility failure, and the failure of an upstream provider. This does not excuse a payment obligation.
Notices
We may give you notice by email to the address on your Organization or by a notice in the workspace. Send notices in writing to support@email.cefense.com. Contact that address to request a postal address when physical delivery is required.
Independent contractors
The parties are independent contractors. These Terms create no partnership, joint venture, agency, or employment relationship.
No third-party beneficiaries
There are no third-party beneficiaries to these Terms.
Export and sanctions
You represent that you are not located in, and are not a national of or controlled by a party in, a country or territory subject to United States embargo, and that you are not on any United States government restricted party list. You will comply with all applicable export control and sanctions laws.
United States government users
The Service is commercial computer software. Government users receive only the rights described in these Terms, consistent with FAR 12.212 and DFARS 227.7202.
Publicity
We will not use your name or logo publicly without your prior written consent.
Interpretation
Headings are for convenience only. "Including" means "including without limitation".
Questions about these Terms, a billing problem, a refund request, a concern, a complaint, or a legal notice all go to one place: support@email.cefense.com.