These Terms of Service ("Terms") govern your access to and use of threatengine.sh and any associated APIs, features, or content (collectively, "the Service"). By accessing or using the Service you agree to these Terms. If you do not agree, do not use the Service.
threatengine.sh is a free, open-source threat intelligence platform that aggregates and cross-links publicly available security data. CVEs, ATT&CK techniques, threat actors, tools, IOCs, detection rules, and compliance frameworks. for use by security professionals, researchers, and students.
The Service is provided as-is, free of charge, for informational and research purposes. It is not a substitute for professional security advice, incident response services, or commercial threat intelligence products.
You must be at least 16 years old to create an account. By creating an account you represent that you meet this requirement. The Service is intended for security professionals, researchers, students, and technically literate individuals. It is not intended for consumers who may be harmed by misinterpreting threat intelligence data.
Accounts are created via Google or GitHub OAuth. You are responsible for maintaining the security of your OAuth credentials and for all activity that occurs under your account. Notify us immediately at security@threatengine.sh if you suspect unauthorised access.
We reserve the right to suspend or terminate accounts that violate these Terms, without notice, at our discretion.
The Service is designed for legitimate security research and defensive use. Using CVE data to understand vulnerabilities in systems you own or are authorised to test is explicitly permitted and encouraged. Using the data to understand attacker TTPs for defensive purposes is the core use case.
We support the security research community and do not restrict use by good-faith security researchers, academics, red teams operating within authorised engagements, or students learning about cybersecurity.
Any notes, project names, or other content you add to your account remain yours. By storing content on the Service you grant us a limited licence to store and display it back to you. We do not use your saved content for any other purpose.
Do not store classified, secret, or highly sensitive data in your projects or notes. The Service is not designed or accredited as a secure store for sensitive intelligence material.
The underlying threat intelligence data comes from public sources including NVD, MITRE ATT&CK, CISA KEV, Sigma, YARA rules, and others, each subject to their own licences (see /credits). We do not claim ownership of this data.
The threatengine.sh software, interface design, and original content are released as open source. The name "threatengine.sh" and associated branding are not licensed for use in competing or derivative commercial products without permission.
No warranty. The Service is provided "as is" and "as available" without any warranties, express or implied, including but not limited to fitness for a particular purpose, accuracy, or non-infringement.
Data accuracy. Threat intelligence data is aggregated from public sources and may contain errors, outdated information, or gaps. Do not rely solely on this data for critical security decisions without independent verification.
No professional advice. Nothing on this Service constitutes legal, compliance, or professional security advice. Consult qualified professionals for your specific situation.
To the maximum extent permitted by applicable law, the operators of threatengine.sh shall not be liable for any direct, indirect, incidental, special, consequential, or exemplary damages arising from your use of or inability to use the Service, even if advised of the possibility of such damages. This includes damages arising from data inaccuracies, service interruptions, or security incidents.
Our total aggregate liability to you for any claim arising from these Terms or your use of the Service shall not exceed the amount you paid us in the twelve months preceding the claim. which, since the Service is free, is zero.
You agree to indemnify and hold harmless the operators of threatengine.sh from any claims, damages, losses, and expenses (including reasonable legal fees) arising from your use of the Service in violation of these Terms, your violation of any law, or your infringement of any third-party right.
We provide the Service on a best-effort basis. We reserve the right to modify, suspend, or discontinue any part of the Service at any time without notice. We also reserve the right to update these Terms. Material changes will be posted on the site. Continued use after changes constitutes acceptance.
These Terms are governed by and construed in accordance with applicable law. Any disputes shall be resolved in the jurisdiction of the service operator. Nothing in these Terms limits rights you may have under applicable consumer protection or data protection laws.