End User Licence Agreement

This is the current published version. The version that travels with your copy of OpenVAPT governs that copy (licence sections 12 and 15; EULA section 27). Earlier versions are in the public Git history.

Version 2.5, effective 2026-10-14. Acknowledgements version 1.8. This Agreement was drafted by an AI Cybersecurity Engineer and reviewed by a separate AI system acting as the project's legal reviewer; no human lawyer drafted or reviewed it (see section 28). Please read it in full. It is written to be plain, honest and complete.

This End User Licence Agreement ("Agreement") applies to everyone who downloads, builds, installs, copies or uses OpenVAPT, including its source code, compiled programs, documentation and website (together, the "Software"). If you do not agree, do not download or use the Software.

1. Who We Are

"We", "us" and "the developers" mean OpenVAPT, meaning the individual who owns and runs the project and publishes it under that name, together with every person who has contributed to it. "You" means the individual, and any organisation on whose behalf that individual acts, who downloads or uses the Software.

"OpenVAPT" is the name of the project and the name under which its rights are held and the Software is licensed. It is not a company, partnership, society or any other legal entity. The licensor of the Software is the individual who owns and runs the project and publishes it as OpenVAPT. References to "we" are made by that individual and for the benefit of every contributor. OpenVAPT is built by AI Cybersecurity Engineers under the direction of that one human owner, who in law is the licensor and bears personally any residual legal risk that is not excluded by this Agreement. The owner's identity is not published.

2. Definitions

Own Use means (a) downloading the Software to computers and servers that you own or control and running it there for your own personal testing and learning, or (b) running it on computers and servers that your company or organisation owns or controls, to test those same machines for the organisation's own internal purposes, where the organisation has authorised you to do so. Business use within your own organisation is Own Use. Own Use never includes selling the Software or providing any service with it.

Teaching has the meaning in the licence and is governed by the Teaching With OpenVAPT terms (TEACHING.md), which form part of this Agreement. Teaching is permitted and is not a service. Teachers and institutions must follow the teacher's checklist in TEACHING.md, may not accept these terms for any student, and are bound by this Agreement, including sections 12 to 15, as users. Every student who downloads or runs the Software must accept this Agreement personally, or through a parent or guardian if under 18.

AI Cybersecurity Engineers means AI systems (Claude by Anthropic, through Claude Code, and OpenAI Codex) acting in a cyber security engineering role in building the Software. They are not people, not registered or professional engineers under the Registration of Engineers Act 1967 or any other law, hold no qualification, and provide no professional engineering or security service. The term describes a role, not a title or qualification.

Commercial Exploitation means selling, renting, licensing or distributing the Software for payment or any other benefit; including it in a product or service for others; or using the Software, or anything from or produced by it (including its reports, code and course material), to provide any service to anyone other than yourself or your own organisation, whether paid or unpaid. Examples are security consulting, scanning or assessing machines for clients, a hosted or managed service, and selling or supplying reports to others.

Not a business. OpenVAPT is not a business. It does not carry on business, trade or commerce, sells nothing, earns nothing, accepts no payments or donations of any kind, and offers nothing to consumers: no goods, no services, no support and no advice. Your permitted Own Use within your own organisation does not make the project a supplier to you or to your organisation. Because the Software is given free of charge, as a gift, and not in the course of any business or trade, we believe it is not a supply of goods or services by a supplier under the Consumer Protection Act 1999, and not a trade description or supply in the course of trade under the Trade Descriptions Act 2011; where any law still implies a guarantee or imposes a liability that cannot be excluded, section 14.4 applies.

No relationship and no duty. Making the Software available, answering questions, or accepting contributions creates no relationship of supplier and consumer, agency, partnership, joint venture, employment, fiduciary, advisory or professional service between you and us, and no duty of care, support, maintenance, update, correction, warning or response. Nobody is authorised to make any promise or representation on behalf of OpenVAPT.

3. Academic Purpose

The Software is an academic, non-commercial project made for learning and open review. It helps people learn vulnerability assessment from the bottom up, from theory to application, and demonstrates how a vulnerability assessment tool can be designed, built and tested. It is not a product, not a service and not professional security advice.

4. Acknowledgement and Acceptance

OpenVAPT is academic, non-commercial, open, source-available code built by AI Cybersecurity Engineers, free to download and use, for your own personal or business use, 100% at your own risk. You may not sell it and you may not use it to provide services.

Before downloading, and again before every scan, you must read, study, understand, acknowledge, agree to and accept each of the following statements. By downloading, building, installing or using the Software you confirm every one of them:

1. I have read, studied and understood the End User Licence Agreement, the Disclaimer, the Acceptable Use Policy, the Licence, the Teaching With OpenVAPT terms and Citing OpenVAPT.
2. I understand that OpenVAPT is an academic, non-commercial project made for learning, and that it is not a penetration test, an audit, a certification, a service or professional advice.
3. I will download and use OpenVAPT only for my own use, personal or business, and only on computers and servers that I own or control, or that my employer owns or controls and has authorised me to assess.
4. I will not sell OpenVAPT, include it in a product, or use it to provide services of any kind to anyone else, paid or unpaid.
5. I understand that automated results can be wrong or incomplete, and that a report without findings does not prove a system is secure.
6. I acknowledge, agree to and accept that I use OpenVAPT 100% at my own risk, and that I alone am responsible for every risk and every consequence, including damage, data loss, downtime, security incidents and legal liability.
7. I agree that OpenVAPT is a free gift from people who are not in business, provided as is, without any warranty, and that, to the fullest extent the law allows, the developers and contributors owe me no duty and accept no responsibility or liability of any kind, and I release them from every claim.
8. I am solely responsible for complying with all laws that apply to me wherever I am, including computer misuse, cyber security, data protection and export laws, such as the Computer Fraud and Abuse Act (United States), the Computer Misuse Act 1990 (United Kingdom), Directive 2013/40/EU (European Union) and the Computer Crimes Act 1997 (Malaysia).
9. I understand that OpenVAPT's code, documentation, website and legal texts were researched, developed, built and reviewed by AI Cybersecurity Engineers (AI systems, not people or registered engineers) under the direction of the project owner, may contain mistakes, and have not been audited by a human security expert or drafted or reviewed by a human lawyer.
10. I am at least 18 years old (or the age of majority where I live), or my parent or guardian has read these statements and accepts them for me in their own name; and where I act for an organisation, I am authorised to bind it.

These statements are version 1.8 of the acknowledgements (version 1.6 changed only the licence version number printed with them; version 1.7 adds statement 10 and names every document in statement 1; version 1.8 gives examples in statement 8 of laws from several regions instead of Malaysian laws only). The version number also changes when the positioning text printed with the statements changes, for example a new licence version number. The version shown by openvapt terms is the one you accept for that copy of the tool.

The website asks you to tick each statement before showing the download instructions. Before every scan, the tool shows the statements and asks you to type I ACCEPT, unless you run it with the --accept-terms option, which is intended for automated use. Using --accept-terms means that you, or the person who set up the automation, have read and accept every statement. Neither the website nor the tool stores or sends your answer anywhere.

5. How This Agreement Is Formed

Formation. You accept this Agreement by ticking the statements on the website, by typing I ACCEPT in the tool, by using the --accept-terms option, or by downloading, building, installing or using the Software, whichever happens first. You agree that accepting electronically is as binding as signing on paper.

Exchange of promises. We allow you to use the Software free of charge, and in exchange you make the promises in this Agreement, which are the consideration for your licence. We receive no money or other payment. The permission we give is a gift: we take on no obligation to you beyond allowing use under the licence, and we make no promise about the Software.

Notice as well as contract. If for any reason this Agreement does not take effect as a contract, sections 12, 13 and 14 still apply as a notice to you: we tell you, before you rely on the Software, that we do not accept responsibility for it and that you must not rely on it. In that case those sections are also conditions of your licence, and using the Software without accepting them is outside your licence.

Age and capacity. You may accept this Agreement only if you are at least 18 years old (or the age of majority where you live, if higher) and legally able to enter into contracts. If you are younger, you may use the Software only with the agreement of your parent or guardian, who accepts this Agreement for you, in their own name, and is responsible for your use. Whether or not a contract is formed with you, the licence conditions and the notice in this section limit what you are permitted to do and what you may rely on. If you accept on behalf of an organisation, you confirm that you are authorised to bind it, and both you and the organisation are bound.

6. Licence

The Software is licensed to you only under the OpenVAPT Source-Available Licence 1.3 (file LICENSE; see the Licence page). In summary:

1. Anyone may use it. Individuals, students, educational institutions, government bodies and companies may download and use the Software free of charge.
2. Own Use only. You may run the Software only for Own Use.
3. No services and no Commercial Exploitation. You may not use the Software to provide services to anyone else, whether paid or unpaid, and you may not sell it, rent it, include it in a product or service, or otherwise commercially exploit it.
4. Credit and citation. If you copy, quote, share, adapt or present any OpenVAPT material, you must credit OpenVAPT as set out in section 5.4 of the licence. We also ask you to cite OpenVAPT in any academic or other work it helped, as explained in CITING.md.

The licence sets out your copyright permissions, and providing services or selling is not licensed under it. This Agreement and the Acceptable Use Policy are conditions of the licence, and this Agreement also sets out the promises you make to us. Where any document appears to permit something that another document prohibits, the narrower rule applies.

7. Authorisation and Lawful Use

1. You must have the legal right to run the Software on the machine where you run it. You may run it only on a machine that you own or control, or that your employer owns or controls and has authorised you to assess. Running the Software on a machine belonging to a client, customer or any other third party is not permitted, even with their permission, because that would be providing a service.
2. You are solely responsible for complying with every law that applies to you in every country where you use the Software or where the machine is located, including computer misuse, cyber security, data protection and communications laws. Examples are the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act 1990 in the United Kingdom, Directive 2013/40/EU and the General Data Protection Regulation in the European Union, and the Computer Crimes Act 1997, the Cyber Security Act 2024 and the Personal Data Protection Act 2010 in Malaysia. These are examples only; the laws of your own country apply in full.
3. The Software is designed to examine only the machine it runs on. You must not modify it, or use any part of it, to examine, access or attack any system you are not authorised to examine.

8. What the Software Does on Your Machine

So that you can decide with full information, this is everything the Software does when you run a scan:

1. It reads files and system information on the machine it runs on, for pattern matching only. These may include sensitive files such as /etc/passwd, /etc/shadow (when run as root), sudo rules, SSH, firewall and web server configuration, systemd service unit files, kernel parameters, package lists, and application configuration files for stacks such as Apache Tomcat, Node.js, Django, Flask, WordPress, Joomla and Drupal, which can contain passwords or secret keys. In full, the files and folders read also include: the boot loader configuration (GRUB files including user.cfg) and the firmware Secure Boot variables under /sys/firmware/efi/efivars; the audit daemon configuration and rules and the journald configuration; the PAM stacks, /etc/login.defs and root's shell start-up files; container runtime configuration for Docker, containerd and Podman, the Docker socket's ownership and permissions, and each container's hostconfig.json and config.v2.json; nginx and Apache configuration trees; MySQL or MariaDB, PostgreSQL (including pg_hba.conf), Redis and MongoDB configuration; Postfix, Dovecot and BIND configuration; application framework files such as .env, Django and Rails settings and key paths; cron tables and cron folders; authorized_keys files of root and of user accounts; the container markers /.dockerenv and /run/.containerenv, /proc/1/cgroup, /proc/self/mountinfo and, when readable, /proc/1/environ (only a container= value is looked for and nothing else from it is kept), read to tell whether the scan runs inside a container; the IPv6 routing table /proc/net/ipv6_route (only the interface name and flags of a default route learned from a router advertisement may appear in a report); dependency lock files found in web document roots (composer.lock, package-lock.json, poetry.lock, Pipfile.lock, requirements.txt, Gemfile.lock, go.mod and Cargo.lock), from which only the file path, package names and versions are kept; Jupyter configuration files under /etc/jupyter, /usr/local/etc/jupyter, /root/.jupyter and /home/*/.jupyter, from which only the file path, whether the token or password is empty and whether cross-site request protection is turned off are recorded, never a token or password; a suppression file you name with --suppress, which is only read and is recorded in the report by its file name (not its folder path), its sha256 checksum and the reason you wrote for each accepted finding; and a bounded walk of /etc and of each web document root (file names and permissions, then the contents of at most 300 world-readable configuration-like files) matched against credential patterns, where only the file name and the kind of pattern are recorded and no matched value is ever copied. The checks look only for weak settings and are designed never to copy secret values into a report.
2. It runs only a fixed allow-list of read-only commands, including sshd -T, apt-get -s upgrade (simulation only), dnf or yum updateinfo, rpm -qa, firewall status commands (nft, iptables, ip6tables, ufw, firewall-cmd), systemctl is-active and systemctl is-enabled, uname -r, node --version, php -v and php -r limited to reading configuration values. It compares the firewall rules with the services that are actually listening. The full list is in the source code (internal/sys), and openvapt scan --dry-run previews every action.
3. It sends ordinary HTTP GET requests and TLS handshakes to the websites and services on the same machine, only through loopback addresses (127.0.0.0/8 and ::1), including requests for a short list of fixed paths such as /.git/HEAD, /.env, /phpinfo.php and common administration pages to see whether they are exposed. These requests may appear in your web server logs and may trigger your security tools.
4. It is designed not to change, delete, install, restart, exploit, attack or brute-force anything, and in its unmodified form it is designed to make no connection to any other machine. Software can contain mistakes, so you must not treat this design as a promise.
5. It uses CPU, memory and disk time while it runs. Each check has a time limit and work is bounded, but on a busy or fragile server even read-only activity can have side effects.
6. It writes a report, which describes weaknesses of your machine, to a folder you choose with --out or, when you do not choose one for openvapt scan, to a new folder named after the time (UTC) inside openvapt-reports in the home folder named by the HOME setting of the user running the scan. Under sudo this is usually root's home folder; if sudo keeps your own HOME and the system's user database confirms that it is inside your own home folder, the folder and reports are given to your user account instead of root, and they are readable only by the account that owns them. Only if you pass --open, and only in a desktop session and never as root, it asks your desktop to open the HTML report it has just written, using /usr/bin/xdg-open. The report also records the command line used, with file paths and other free values replaced by a placeholder, and a confidence level for each finding. As a second safeguard, the report is also redacted by pattern matching, which may not catch everything. Protecting and sharing the report is your responsibility.
7. If you enable signing (the default), it creates a private key on your machine in your user configuration folder (for root, under root's home). Keep it private.

9. How OpenVAPT Is Made (Built by AI Cybersecurity Engineers)

All of the Software, including its design, code, tests, documentation, website, course material and these legal drafts, was researched, developed and built by AI Cybersecurity Engineers, directed and approved by the human project owner, who decides what is built and published but has not hand-written the code. The AI systems used are listed in AI-DISCLOSURE.md: Claude (by Anthropic, through Claude Code) produced the work, and OpenAI Codex reviewed the code, proposed and implemented fixes, and built parts of the code to Claude's specification (network, data-service and TLS checks, the report redesign and the vulnerability matching engine), each reviewed by Claude before merging. These legal documents were reviewed by Claude acting as the project's legal reviewer (an AI lawyer). No independent human security expert has audited the code, and no human lawyer has drafted or reviewed these documents. Work built by AI Cybersecurity Engineers can contain mistakes, including security and legal mistakes. The full source code, tests and history are public so that anyone can review them. Commits made with AI assistance carry a Co-Authored-By line.

Because the Software was built by AI Cybersecurity Engineers, copyright may not exist in some parts under the laws of some countries. The licence and this Agreement apply to the Software to the extent that copyright and other rights exist in it. Your promises in this Agreement, including the promise not to sell the Software or use it to provide services, apply to all of the Software regardless of whether copyright exists in any particular part.

10. Third-Party Components and Sources

The compiled program contains OpenVAPT's own code, the Go standard library (BSD 3-Clause licence) and, in release builds, an embedded snapshot of public vulnerability advisory data (OSV ecosystem exports and the CISA Known Exploited Vulnerabilities catalogue). The advisory data belongs to its publishers and is used under their terms, listed in THIRD_PARTY_NOTICES.md; the snapshot in the source repository is a small test fixture. The website additionally uses self-hosted copies of AG Grid Community (MIT), Apache ECharts (Apache-2.0), Lucide icons (ISC) and the IBM Plex fonts (SIL Open Font License 1.1). Each component's licence applies to that component. Every component, tool, standard and source used or referred to is listed in CREDITS.md and THIRD_PARTY_NOTICES.md.

Hosting and the installer. The source code, releases and the one-command installer (scripts/install.sh) are hosted by GitHub, a third party that we do not control. The installer is optional. It is designed to verify each download's checksum, scan nothing unless you pass --run, and never accept the terms for you, but running any script downloaded from the internet is your own decision and risk, and the installer is part of the Software for every purpose of this Agreement.

11. The Operator and Notices

OpenVAPT is run by its project owner. The project publishes no email address and no postal address; it is contacted through GitHub only.

Notices. You agree that we may give you any notice about the Software, the licence or this Agreement by (a) posting it in a GitHub Issue, Discussion or security advisory in the repository at github.com/OpenVAPT/openvapt, or (b) commenting on, or replying to, any GitHub issue, pull request, discussion or repository where you are involved. A notice is treated as received when it is posted. You may give notice to us by opening a public GitHub Discussion (never including secrets or personal data) or, for security flaws, through GitHub Private Vulnerability Reporting. We are not obliged to reply.

12. Your Risk, 100%

1. You use the Software entirely at your own risk. You alone decide whether to download, run or rely on it, and you alone bear every consequence.
2. The Software performs automated, read-only checks. It may still behave unexpectedly, consume resources, produce wrong results, or miss weaknesses. You should test it on a non-production system first and keep backups.
3. Results are not proof that a system is secure or insecure. Every decision you take based on the Software or its reports is your own responsibility.
4. Pre-release builds. Builds published on the alpha, beta and release candidate (rc) channels are pre-release. They are unfinished, may be wrong, incomplete or unstable, may change or be withdrawn at any time, and are used 100% at your own risk. Only a build published on the stable channel is a full release, and it too is provided as is, without any warranty.

13. No Warranty

To the fullest extent permitted by law, the Software is provided "as is" and "as available", with all faults, and without any warranty, guarantee, condition or representation of any kind, whether express, implied or statutory, including any warranty of merchantability, quality, fitness for a particular purpose, accuracy, completeness, security, availability, non-infringement, or that the Software will be free of errors, defects or harmful components.

14. No Liability

1. To the fullest extent permitted by law, the developers shall not be liable to you or to anyone else for any loss or damage of any kind arising from or connected with the Software, the website or this Agreement, however caused and under any legal theory (including contract, tort, negligence, breach of statutory duty or otherwise), even if advised of the possibility of such loss or damage.
2. This includes, without limitation, direct, indirect, incidental, special, consequential, exemplary or punitive damages; loss of data, profits, revenue, business, goodwill or reputation; system downtime or damage; security incidents or breaches; vulnerabilities that were not detected; regulatory penalties; and claims by third parties.
3. Where the law does not allow our liability to be excluded entirely, our total liability to you for all claims together, of every kind, is limited to the smallest amount the law permits, and in any case to no more than one United States dollar (USD 1), or its equivalent in your currency, where the law permits a cap of that size. This reflects that the Software is given free of charge, as a gift, and that you have chosen to use it at your own risk.
4. Nothing in this Agreement excludes or limits any liability that cannot be excluded or limited by law, which may include liability for fraud, for wilful misconduct, or for death or personal injury caused by negligence. Every exclusion in this Agreement applies to the fullest extent the law allows and is read down, not removed, where it goes further.
5. Release. To the fullest extent the law allows, you release the developers and every contributor from every claim, known or unknown, arising from or connected with the Software, the website or this Agreement, and you agree not to bring any such claim against them. This release does not apply to liability that cannot lawfully be excluded.
6. No reliance. You confirm that you have not relied on any statement, description, check result, course material or answer from us when deciding to use the Software, and that you will make your own checks before acting on any Output.
7. Each contributor may rely on and enforce sections 12 to 15 as if a party to this Agreement.

15. Indemnity

You agree to indemnify the developers against any claim, demand, loss, penalty, cost or expense (including reasonable legal fees) made or brought by any third party or authority, to the extent it arises from (a) your breach of this Agreement or the Acceptable Use Policy, (b) your use of the Software on a machine you were not entitled to examine, (c) your breach of any law, or (d) your modification of the Software or your sharing of reports. This indemnity does not apply to the extent a loss is caused by the fraud or wilful misconduct of the developer claiming it.

16. No Support and No Obligation

The developers have no obligation to provide support, maintenance, updates, fixes or answers. Any help given in public GitHub discussions is voluntary, general and given without liability. Timelines in the Security Policy are voluntary aims, not promises.

17. No Data Collection

The Software does not send any data to the developers or anyone else, and the website collects no data. See the Privacy Policy, which is an information notice and does not create contractual obligations.

18. Export and Sanctions

You are responsible for complying with all export control, sanctions and trade laws that apply to you, for example the Export Administration Regulations in the United States, Regulation (EU) 2021/821 in the European Union and the Strategic Trade Act 2010 in Malaysia. You confirm that you are not a person or entity named on any sanctions list that applies to you, and that you will not use or provide the Software in breach of any sanctions. The Software is designed to contain detection logic only. It contains no exploit, intrusion, payload or attack code, and its full source code is published openly. We make no statement about how any export control law classifies the Software; you must decide that for your own situation.

19. Name and Endorsement

"OpenVAPT" and the OpenVAPT logo identify this project. They are not registered trademarks, but you may not use them in a way that suggests that a product, service, report, certificate or organisation is provided, approved, certified or endorsed by OpenVAPT or its developers. You may use the name to refer accurately to the Software, for example "assessed with OpenVAPT, an academic tool". A modified version must not be called OpenVAPT without clearly saying it is modified.

Third-party names. Names of other projects, products and organisations, such as Linux, Go, Lynis, OpenSCAP, OpenVAS, Nuclei, Trivy, ZAP, Apache Tomcat, Node.js, Django, Flask, WordPress, Joomla, Drupal, Claude and Codex, are used only to identify them and to describe what the Software checks or how it was made. They belong to their owners, who do not sponsor, endorse or have any connection with OpenVAPT.

20. Contributions and Feedback

Contributions. By submitting a contribution (code, documentation or other material) you confirm, through the Developer Certificate of Origin sign-off, that you have the right to submit it, and you license it under the OpenVAPT Source-Available Licence 1.3 and grant the licensor the licence to relicense it set out in section 10 of the licence. You keep your copyright. You must disclose in your pull request if an AI Cybersecurity Engineer or other AI system produced any part of your contribution.

Feedback. If you share an idea, suggestion or report (for example in a GitHub Issue or Discussion), you agree that we may use it freely, without payment, attribution or any obligation to you.

21. Termination

Your rights under this Agreement and the licence end automatically if you breach either of them. We may, but need not, reinstate them in writing. On termination you must stop using and delete the Software. Sections 1, 2, 4, 6 (restrictions only), 9, 12 to 15, 18 to 20 and 22 to 29 survive termination, together with any other term which by its nature is meant to continue.

22. Governing Law

OpenVAPT is offered to anyone, in any country, free of charge, subject to the Own Use limit and the laws that apply to you. The choice of law below only reflects where the licensor is; it does not limit who may use the Software. This Agreement is governed by the laws of Malaysia. The courts of Malaysia have exclusive jurisdiction over any dispute, unless the law of your country gives you a right to bring proceedings there. Nothing in this section takes away any protection that the mandatory laws of the country where you live give you and that cannot be excluded by agreement. We may seek urgent relief to stop misuse of the Software in any court with jurisdiction.

23. Assignment

You may not transfer your rights or obligations under this Agreement to anyone else. We may transfer the project, the Software and our rights and obligations under this Agreement to another person or organisation, including a company or other body formed to look after the project. If we do, this Agreement continues to apply between you and the new owner.

24. No Waiver

If we do not enforce, or delay enforcing, any part of this Agreement, that does not give up our right to enforce it later. A waiver is effective only if we publish it in writing on the GitHub repository.

25. Force Majeure

We are not responsible for any failure or delay caused by events beyond our reasonable control, including the unavailability of GitHub, the hosting provider, the internet, or any natural disaster, epidemic, war, government action or power failure.

26. Interpretation and Language

Headings are for convenience only and do not affect meaning; "including" and similar words mean "including without limitation"; the singular includes the plural and the other way round; "law" includes legislation, regulations and court decisions; and "writing" includes electronic messages and posts on the GitHub repository. This Agreement is written in English. If it is translated, the English version prevails to the extent of any difference.

27. Changes

We may update this Agreement. Each version is dated and kept in the public Git history. Version 2.2 (2026-10-13) states plainly who stands behind the project (section 1) and changes no right or obligation. Version 2.3 (2026-10-13) refers to licence 1.2 and summarises its Credit condition and the citation request (section 6.4); the acknowledgements are unchanged. Version 2.4 (2026-10-14) corrects the stated acknowledgements version to the one the tool shows, adopts acknowledgements 1.7 (statement 1 names every document that forms this Agreement and statement 10 confirms age, guardian acceptance and authority to bind, matching section 5), refers to licence 1.3, describes OpenAI Codex's role accurately (section 9) and discloses the embedded advisory data (section 10); it changes no right or obligation of the licensor or the user, other than that statement 10 asks you to confirm what section 5 already required. On 2026-10-14 version 2.4 received a factual addition to section 8.1 listing the further files and folders the Software reads (boot loader, audit, PAM, container runtime, web server, database, mail and DNS configuration, framework settings files, cron, authorized_keys and the bounded credential pattern walk); it describes what the Software already did, grants nothing new and takes nothing away, and the version number is unchanged. Version 2.5 (2026-10-14) states that OpenVAPT is open to users in every country and that mandatory protections of your own country's law are kept (section 22), adopts acknowledgements 1.8 (statement 8 names computer misuse laws from several regions as examples instead of Malaysian laws only), gives examples of laws from several regions in sections 7 and 18, and expresses the liability cap in section 15 as USD 1 or its equivalent instead of RM1; the cap's effect and every other right and obligation are unchanged. On 2026-10-14 version 2.5 received a factual addition to section 8.1 (the container marker files, /proc/net/ipv6_route and the --suppress file) and to section 8.6 (the sanitised command line and per-finding confidence recorded in reports); it describes what the Software does, grants nothing new and takes nothing away, and the version number is unchanged. On 2026-10-14 version 2.5 also received a factual addition to section 8.6 (the default report folder ~/openvapt-reports/ and the optional --open); it grants nothing new, takes nothing away, and the version number is unchanged. On 2026-10-14 version 2.5 also received a factual correction to section 8.6 describing which account owns the default report folder when the Software runs under sudo; it grants nothing new, takes nothing away, and the version number is unchanged. On 2026-10-16 version 2.5 received a factual addition to section 8.1 (dependency lock files for Python, Ruby, Go and Rust found in web document roots, and Jupyter configuration files) describing what new checks read; it grants nothing new, takes nothing away, and the version number is unchanged. The version in force when you obtain a copy of the Software applies to that copy, and the version shown when you accept in the tool applies to that use.

28. How This Agreement Was Reviewed

This Agreement was drafted by an AI Cybersecurity Engineer in good faith and reviewed by a separate AI system acting as the project's legal reviewer (an AI lawyer). No human lawyer drafted or reviewed it, and it is not approved by any human lawyer. Nothing in it is legal advice to you; if you need legal advice, consult your own qualified lawyer. Its wording may change; every version is dated and kept in the public Git history.

29. Whole Agreement and Severability

Whole agreement. This Agreement, the licence, the Acceptable Use Policy and the Teaching With OpenVAPT terms are the whole agreement between you and us about the Software. The Disclaimer forms part of this Agreement. The Privacy Policy and Security Policy are information notices and do not create contractual obligations for us. You confirm that you have not relied on any statement, promise or representation that is not written in these documents.

Severability. If any part of this Agreement is found invalid, illegal or unenforceable in any place, that part is changed to the minimum extent needed to make it enforceable there, or, if that is not possible, removed there. The rest of this Agreement remains in full force, and the part stays in force in every other place.

Remedies. Because misuse of the Software could cause harm that money cannot repair, we may seek an injunction or specific relief, including under the Specific Relief Act 1950, to stop a breach, in addition to any other remedy.