Terms of Service

These terms are an agreement between you and DesSecurity (Gadson House, 1st Floor, Plot 9, Rd 2, Sector-19, New Panvel, Navi Mumbai, MH, 410206), the company that runs Dependency Map. By creating an account or starting a scan, you agree to these terms and to our Privacy Policy, which explains how we handle your data.

You must be at least 18 to use DesSecurity. If you use it on behalf of a company or other organization, you confirm that you are allowed to accept these terms for it, and "you" includes that organization.

Dependency Map (the "Service") downloads a GitHub repository you choose and analyzes it. It lists the dependencies, matches them against public vulnerability databases, checks whether your code calls the affected functions, looks for leaked secrets and risky function calls, and shows the results in reports, dashboards and CSV or SBOM exports.

The Service reads your files; it never runs your code. It is at an early stage, so features may be added, changed or removed as we improve it.

• Give accurate details when you sign up, and keep them up to date.
• Keep your sign-in secure. You are responsible for what happens under your account.
• Tell us at kshitija.k@des-security.com straight away if you think someone else has used your account.
• One person per account. Do not share your sign-in.

Only scan repositories you are allowed to. When you start a scan, you confirm that you own the repository or have permission from its owner to have it analyzed, including any personal data or secrets it contains.

Permission to analyze. You allow us to download the repository and process its files only to produce your results. We delete the files when the scan ends, as described in the Privacy Policy.

GitHub access. When you sign in with GitHub, GitHub may describe the permission it grants as read and write access. We only read.

Checking leaked secrets. If a scan finds a secret, such as an API key, you allow us to send it to the service that issued it, only to check whether it still works so we can mark it "Live". Finding a secret does not make us responsible for it: revoking and replacing it is up to you or its owner.

You must not:

• scan repositories you have no right to scan, or use the results to attack anyone;
• test, probe or attack the Service, or try to get around its sign-in, limits or security, except as described in security reports below;
• overload the Service, for example with automated bulk scanning beyond the limits we set;
• copy, resell or offer the Service to others, or build a competing product from it, without our written permission;
• use the Service to break any law, including the Information Technology Act, 2000.

Your code stays yours. We claim no ownership of it, and we do not use your code or your results to train AI models.

Your results. You may use your reports and exports for any lawful purpose, including sharing them with your team, customers or auditors.

Our service. The Service, its software and its design belong to DesSecurity. These terms give you the right to use it, not to own it.

Results are produced automatically and can be wrong in both directions: they can flag something that is not a real problem, and miss something that is.

• Vulnerability data comes from public sources such as OSV.dev, FIRST (EPSS) and CISA (KEV). It may be incomplete or out of date.
• Reachability verdicts and risky-API findings are leads for review. "Unconfirmed" or "Dynamic" does not mean safe.
• A clean report does not mean a repository has no vulnerabilities or no secrets.
• Alternative-package suggestions come from your own AI provider. Check them before you switch packages.

The Service supports your security work; it does not replace professional review. You decide what to fix and when, and you are responsible for those decisions.

The Service relies on others, including GitHub, Clerk for sign-in, and the vulnerability databases above. Their own terms apply to your use of them, and we are not responsible for their availability or accuracy.

If you add your own Claude, OpenAI or Gemini key, your provider may charge you for its use, and its terms apply to what we send it. The Privacy Policy lists what that is.

Using the Service is currently free. If we introduce paid plans, we will show the price, billing period, and cancellation and refund terms before you subscribe. We will never charge you without your agreement.

We work to keep the Service running, but it may sometimes be slow or unavailable, for example during maintenance or a problem with a provider we rely on. We may set or change usage limits, such as how many scans you can run.

If we make a change that removes a feature you rely on, or stop the Service altogether, we will email you in advance where we can, so you can export your results.

You can leave at any time. Email kshitija.k@des-security.com from your account's email address to close your account. Your data is then deleted as the Privacy Policy describes.

We may suspend or close an account that breaks these terms, puts the Service or other users at risk, or where the law requires us to. Unless the law or a security risk prevents it, we will tell you why and give you a chance to respond.

Sections that by their nature should last after an account is closed, such as limitation of liability and governing law, continue to apply.

To the extent the law allows, the Service is provided "as is" and "as available". We do not promise that it will be uninterrupted or error-free, or that it will find every vulnerability, secret or risky call in your code.

To the extent the law allows:

• We are not liable for indirect or consequential losses, such as lost profits, lost data, or a security incident that a scan did not detect.
• Our total liability to you for any claim about the Service is limited to what you paid us in the 12 months before the claim.

Nothing in these terms limits liability that the law does not allow to be limited, or your rights under the Digital Personal Data Protection Act, 2023.

If someone makes a claim against us because you scanned a repository you had no right to scan, or otherwise broke these terms, you will cover our reasonable costs of dealing with that claim.

Feedback. If you send us ideas or suggestions, we may use them freely, without owing you anything.

Security reports. If you find a security problem in DesSecurity, please email kshitija.k@des-security.com with the details and give us a reasonable time to fix it before telling anyone else. Do not access other users' data or disrupt the Service while looking.

We will post changes on this page with a new effective date. For important changes, we will email you before they take effect. If you keep using the Service after that, you accept the new terms; if you do not agree, you can close your account.

These terms are governed by the laws of India. Before going to court, please contact us so we can try to resolve the problem together. The courts in Mumbai have jurisdiction over any dispute about these terms. This does not limit your right to complain to the Data Protection Board of India about your personal data.

For questions about these terms, contact Kshitija Kulkarni at kshitija.k@des-security.com.