Intended Use

Overview

fossabot is intended to strategically manage different parts of your application life-cycle.

1. Upgrade application dependencies to react to vulnerabilities found and to maintain regular upgrade cadence
2. Adapt application code to changes in dependencies to maintain compatibility
3. Review code as it's proposed for license issues caused by AI coding agents
4. Review code as it's proposed for security and logic issues
5. Audit code as it's released to ensure it meets your compliance obligations

Trusted Repositories

fossabot is intended to be used with code repositories that you trust and control. Security controls exist to protect the availability and integrity of the system and the confidentiality of any processed code, but the first line of defense is using fossabot with trusted application code.

fossabot's access to your code is bounded by the permissions you granted its source control integration (see Setup for the current permission list). If a new feature requires additional permissions, your organization administrator must review and approve the new permission grant before fossabot can use it.

Change Management Policies

fossabot is intended to pass through your organization's existing change management policies. If your policy requires human review or sign off before changes are merged, fossabot dependency upgrades or code fixes should be reviewed accordingly.

fossabot code review takes in application context to provide an accurate assessment and attempts to remove as many false positives as possible. Engineers should always double check the assessment for correctness before merging code.

fossabot SaaS Service

fossabot is a hosted service that is regularly updated with new features, bug fixes and security improvements. You cannot opt-out of the service's automatic upgrades.

Security controls protect the availability and integrity of the service and the confidentiality of your processed code. See System Architecture for how your code is isolated during analysis.

Material changes to data handling or retention, such as changes to what is stored after analysis or for how long, will be reflected in the Privacy Policy.

Configuration changes you make, such as enabling new integrations or expanding fossabot to additional repositories, expand the code and metadata that fossabot accesses and transmits for analysis, including transient processing by Anthropic as described in the Privacy Policy. Review these changes through your own change management process, as described above.

Decommission

Should you wish to decommission your usage of fossabot, you can revoke access to your code at any time and remove all integrations in your fossabot settings. Revoking access and removing integrations stop all future access to your code, but do not delete existing analysis results or related metadata, which are retained only as long as necessary to provide the service. Your source code is processed transiently and is not stored beyond what is required to complete each analysis, as described in the Privacy Policy.

You may request account or organization deletion via support ticket, and request deletion of Personal Data collected by fossabot by contacting privacy@fossa.com.

fossabot Private Saas Tenancy

fossabot is available to be hosted as a dedicated/private tenancy that is separated from other customers. These instances are upgraded by FOSSA engineers but customers have more control on when the upgrades take place.

Upon decommissioning, the entire tenancy is destroyed.