Third-party notices

Cyber Securitise (the dashboard, the free site check and the WordPress plugin) uses the following third-party code and data. Shown at /third-party.

ai.robots.txt (MIT)

https://github.com/ai-robots-txt/ai.robots.txt. The list of AI crawlers and what each one does (robots.json) is the source of the plugin's built-in AI crawler list and of the list the dashboard publishes daily (crawlers:fetch, App\Domain\Intel\AiCrawlerList). Its generated block rules showed how to match user agents (whole tokens, case-insensitive).

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

gitleaks (MIT)

https://github.com/gitleaks/gitleaks. The secret-detection rules (config/gitleaks.toml) and method (keyword prefilter, regex, entropy, allowlists) used by nova-shield/includes/scan/secrets.php, shared with the free site check. Test fixtures from its rule definitions are used in the tests.

MIT License

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Linux Malware Detect signatures (GNU GPL v2)

Linux Malware Detect, (C) 2002-2026, R-fx Networks [email protected], (C) 2026, Ryan MacDonald [email protected]. The threat database that every Cyber Securitise install downloads (the signed bundle of GET /v1/intel) includes file fingerprints (SHA-256) and hex patterns taken from its signature pack, the web-related families only, refreshed daily (intel:import maldet). The bundle carries this notice in its attribution field.

These signatures are licensed under the GNU General Public License, version 2: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html (also https://github.com/rfxn/linux-malware-detect/blob/master/COPYING.GPL). They come with no warranty.

Source: the signatures are redistributed unmodified apart from selection and conversion (hex patterns are written as the equivalent regular expressions). The complete source is the signature pack published by R-fx Networks at https://cdn.rfxn.com/downloads/maldet-sigpack.tgz, from the project page https://www.rfxn.com/projects/linux-malware-detect/ and https://github.com/rfxn/linux-malware-detect. For at least three years from the last time we distribute a bundle, anyone may ask us for a copy of the corresponding signature pack we used, at no charge beyond the cost of sending it: write to the contact address on this site.

Phishing.Database (MIT)

https://github.com/Phishing-Database/Phishing.Database. Its active phishing domains (phishing-domains-ACTIVE.txt, via https://phish.co.za/latest/) are part of the threat database's domains (intel:import phishdb) and of the phishing category of Cyber Securitise Family (family:fetch-lists), refreshed daily.

MIT License

Copyright (c) 2018-2025 Mitchell Krog - github.com/mitchellkrogza Copyright (c) 2018-2025 Nissar Chababy - github.com/funilrys Copyright (c) 2018-2025 Phishing.Database Contributors - github.com/Phishing-Database

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Web shell detection rules (YARA)

The threat database converts some public YARA rules into its own patterns (intel:import neo23x0 pmf pressidium yararules, daily; App\Domain\Intel\Yara). A rule is used only when one regular expression keeps its meaning exactly; the others are skipped. Every finding names the rule, its author and the rule set's licence, and the bundle's attribution lists the sets it holds.

signature-base by Florian Roth (Nextron Systems) and the rule authors named in each rule, https://github.com/Neo23x0/signature-base (the web shell rule files in yara/). Rules that name a different licence are not used. Licensed under the Detection Rule License (DRL) 1.1:
Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files (the "Rules"), to deal in the Rules without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Rules, and to permit persons to whom the Rules are furnished to do so, subject to the following conditions:

If you share the Rules (including in modified form), you must retain the following if it is supplied within the Rules:
1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
2. a URI or hyperlink to the Rule set or explicit Rule to the extent reasonably practicable
3. indicate the Rules are licensed under this Detection Rule License, and include the text of, or the URI or hyperlink to, this Detection Rule License to the extent reasonably practicable
If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:
1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE RULES.
php-malware-finder by jvoisin and contributors, https://github.com/jvoisin/php-malware-finder (data/*.yar), GNU Lesser General Public License v3: https://www.gnu.org/licenses/lgpl-3.0.html (with the GNU GPL v3 it builds on: https://www.gnu.org/licenses/gpl-3.0.html). Most of its rules depend on a whitelist of file hashes and cannot be converted exactly, so few or none are used.
Pressidium YARA rules by Pressidium (rules by Spyros Maris), https://github.com/pressidium/pressidium-yara-rules, GNU General Public License v3: https://www.gnu.org/licenses/gpl-3.0.html.
Yara-Rules (the webshells folder) by the Yara-Rules project and the rule authors named in each rule, https://github.com/Yara-Rules/rules, GNU General Public License v2: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html.

These rule sets come with no warranty. ReversingLabs' YARA rules (MIT) were reviewed and are not used: none targets PHP or web pages.

Written offer (GPL and LGPL data)

The threat bundle holds data converted from GPL and LGPL sources (Linux Malware Detect, php-malware-finder, Pressidium, Yara-Rules). Each archive we convert from is kept for three years. For three years from when you received a bundle, anyone may ask us for the exact source archive its entries came from, at no charge beyond the cost of sending it: write to the contact address on https://cybersecuritise.com/contact/. The sources are also public at the addresses above.

Network lists

Spamhaus DROP and ASN-DROP (The Spamhaus Project SLU, https://www.spamhaus.org/drop/, terms https://www.spamhaus.org/drop/terms/): networks to drop traffic from; fetched at most once a day (intel:import spamhaus). The bundle carries the list's own dated copyright line. ASN-DROP lists networks by AS number; their address ranges come from iptoasn.com (Open Data Commons Public Domain Dedication and License, https://opendatacommons.org/licenses/pddl/1-0/).
Tor exit lists from Tor Metrics' CollecTor, The Tor Project (https://metrics.torproject.org/collector.html, CC0 1.0).
X4BNet lists_vpn (https://github.com/X4BNet/lists_vpn): VPN and data-centre ranges.

MIT License

Copyright (c) 2024 X4B (Mathew Heard)

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
IP Geolocation by DB-IP (https://db-ip.com): the "IP to Country Lite" table, licensed under Creative Commons Attribution 4.0 (https://creativecommons.org/licenses/by/4.0/), packed and signed for sites' country blocking (intel:geo, GET /v1/intel/geo).
Crawler address ranges (Google, Bing, Apple, DuckDuckGo, OpenAI, Perplexity) are not copied: the bundle names the operators' own URLs and each site fetches them.

Vulnerability data

Wordfence Intelligence (Defiant Inc.): WordPress core, plugins and themes (see the notice under every vulnerability list).
GitHub Advisory Database (https://github.com/advisories), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), via OSV.dev (Packagist and npm records with GHSA identifiers only): Composer and npm libraries (feed:import osv-packagist osv-npm). Each record links to its advisory.
FriendsOfPHP security advisories (https://github.com/FriendsOfPHP/security-advisories, Unlicense): Composer libraries (feed:import friendsofphp).
CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog, CC0 1.0): marks vulnerabilities as "actively exploited" (feed:import kev).
NVD (https://nvd.nist.gov/, public domain): CVSS scores for library advisories that have none (feed:import nvd). This product uses the NVD API but is not endorsed or certified by the NVD.

Sign-up spam

disposable-email-domains (https://github.com/disposable-email-domains/disposable-email-domains, CC0 1.0): throw-away email services refused at free sign-up.

Other data and code

CERT Polska warning list (CERT Polska / NASK-PIB, https://cert.pl/en/warning-list/): phishing and scam domains, part of the threat database's domains (intel:import certpl), refreshed daily. Its data usage policy allows any use, commercial included, without any warranty as to its completeness or accuracy; CERT Polska does not endorse Cyber Securitise.
The Block List Project (Unlicense, public domain, https://blocklistproject.github.io/Lists/): the adult (porn) and gambling lists of Cyber Securitise Family, and its phishing, scam and ransomware lists (the phishing and scam categories, on for every device), refreshed daily (family:fetch-lists).
stalkerware-indicators (CC BY 4.0, Echap, https://github.com/AssoEchap/stalkerware-indicators): stalkerware package names, signing certificates and app hashes for the security scan of the Cyber Securitise app, refreshed daily (family:fetch-intel).
qrcode-generator (MIT, Kazuhiko Arase): QR codes for two-step sign-in in the plugin.

Test my chatbot: test prompts

Imported from public datasets on Hugging Face and sent to your own chatbot during a test; the dataset of each prompt is shown in the report.

deepset/prompt-injections (Apache-2.0, deepset GmbH): prompt injection.
JailbreakBench / JBB-Behaviors (MIT, Chao et al., 2024; partly from AdvBench and HarmBench, MIT): harmful requests and harmless controls.
Lakera / gandalf_ignore_instructions (MIT, Lakera AI): system prompt extraction and secret leaks.
gabrielchua/off-topic (MIT, Gabriel Chua, GovTech Singapore): off-topic use.
SPML Chatbot Prompt Injection (MIT, Sharma et al., 2024): prompt injection.