Terms

Licence

The rigorrun package and its source are released under the MIT licence. The full text ships in the package and is in the repository. You may use it commercially, modify it and redistribute it, subject to that licence.

No warranty

As the MIT licence states, the software is provided "as is", without warranty of any kind. That is worth restating in plain language given what this tool is for:

• A passing verdict is a statement about the checks that ran, against the parts of your system RigorRun was able to read, at the moment it ran. It is not a guarantee that your agent is safe, correct or compliant.
• A verdict against a real system is PARTIAL by design, and a verdict from a browser connection is OBSERVATIONAL. Both are labelled on every result. Treating either as stronger than it says it is, is a misreading this documentation cannot prevent.
• RigorRun runs against systems you point it at, using credentials you supply, and it performs actions that change data. Point it at staging. Deciding what is safe to run it against is yours.

Acceptable use

rigorrun verify downloads and executes third-party packages in a container in order to observe them. Use it on software you are entitled to analyse. Publishing a finding about somebody else's server is your responsibility, and the record it produces carries the limits of what was actually established — please do not quote the finding without them.

The website

Content on rigorrun.xyz is provided for information. Figures on the evidence pages are generated by scripts in the repository and can be reproduced; they describe specific runs on specific days against specific versions, and nothing more.

Changes

These terms may change as the product does. Material changes will appear in the changelog. If something here is unclear, ask.