# Licensing and attribution

Copyright (c) 2026 Security Research Library contributors, for original material to the extent copyright or similar rights apply and the contributors have authority to license it.

This repository uses different licenses for software and educational content. They are not interchangeable options for every file.

## Software: MIT

Original maintenance code in `scripts/`, tests in `tests/`, JSON schema definitions in `schema/`, and repository configuration are licensed under the [MIT License](LICENSES/MIT.txt). Keep its copyright and permission notice with copies or substantial portions of that software. The software is provided without warranty.

Running an exporter does not apply its software license to the exported research content.

## Educational content: CC BY 4.0

Original documentation, educational summaries, defensive analysis, taxonomy descriptions, diagram descriptions and original diagrams are licensed under [Creative Commons Attribution 4.0 International](LICENSES/CC-BY-4.0.txt), subject to the exclusions below. This covers original material in `README.md`, `DATA_POLICY.md`, `docs/`, `data/` and `diagrams/`, including Mermaid, DOT and SVG forms of the diagrams.

The same license applies, to the extent the contributors hold such rights, to the original selection and arrangement of the collection and any applicable database rights. It does not create exclusive rights in individual facts.

When sharing covered material, retain attribution and notices, link to the license, and indicate changes as required by CC BY 4.0. A suitable credit is: “Security Research Library contributors, [Security Research Library](https://github.com/gkdataio/security-research-library), CC BY 4.0; changes: [describe changes, if any].” Preserve any other supplied attribution that applies. The license permits adaptation and commercial reuse and is irrevocable for uses that comply with its terms. Its warranty and liability disclaimers apply.

## Facts, third-party material and mixed JSON

- Dates, reward amounts, identifiers and other facts are recorded with provenance. No new copyright restriction is asserted over facts themselves, and lawful uses that need no permission remain unaffected.
- Third-party articles, reports, excerpts and quotations remain subject to their own rights and terms. They are excluded from the repository's MIT and CC BY grants. This includes `reward.evidence_quote` values and any other identified source quotations, even when included in a JSON record or generated export.
- Source titles, author names, source URLs and other attribution identify the original material; their presence does not transfer ownership or relicense the linked work. Brand names, trademarks and logos are not licensed by this repository. No vendor or researcher endorsement is implied.
- Canonical JSON under `data/` and generated JSON under `exports/` contain a mixture of original commentary, facts and source-attributed material. Apply the scope above to each part. Keep provenance and the third-party exclusions when redistributing the collection; consult the original source for rights to its content.

These scope statements identify what the contributors can license. They do not add restrictions to the standard MIT or CC BY 4.0 terms or limit applicable copyright exceptions.

## License text provenance

The MIT terms were checked against the [Open Source Initiative's MIT text](https://opensource.org/license/mit). The bundled text comes from the [SPDX MIT template](https://github.com/spdx/license-list-data/blob/31ba1a50e5397e00a304dbadc76531740e89ee48/text/MIT.txt), with only its year and copyright-holder placeholders completed.

CC BY 4.0 terms were checked against the [Creative Commons legal code](https://creativecommons.org/licenses/by/4.0/legalcode.en). The bundled text is the [SPDX CC-BY-4.0 text](https://github.com/spdx/license-list-data/blob/31ba1a50e5397e00a304dbadc76531740e89ee48/text/CC-BY-4.0.txt). Creative Commons dedicates its public-license text to the public domain; this does not change the license chosen for this collection's original content.