Intended Use

Overview

fossabot is an AI agent intended to strategically manage different parts of your application life-cycle.

1. Upgrade application dependencies to react to vulnerabilities found and to maintain regular upgrade cadence
2. Adapt application code to changes in dependencies to maintain compatibility
3. Review code as it's proposed for license issues caused by AI coding agents
4. Review code as it's proposed for security and logic issues
5. Audit code as it's released to ensure it meets your compliance obligations

How fossabot Uses AI

fossabot is an AI system within the meaning of the EU AI Act. Its analysis results, pull request descriptions, review comments, and proposed code changes are generated by large language models.

fossabot exclusively uses LLM and AI services from Anthropic, under an enterprise agreement with no training on or retention of your data. The data sent to these services includes dependency manifests, diffs, changelog excerpts, and small snippets of your source code derived from earlier local analysis. See System Architecture for how this context is built and the security boundaries between analysis stages.

Capabilities and Limitations

fossabot's output is generated by AI and can be incorrect or incomplete. For example, it may recommend the wrong fix version, misread a changelog, or miss a breaking change in a dependency upgrade. Results are also non-deterministic: running the same analysis twice can produce different findings or proposed changes.

Coverage and accuracy vary by language, package manager, and ecosystem. See Supported Ecosystems for what fossabot analyzes today.

These limitations are why fossabot only proposes changes and never merges them, as described in Human Oversight below.

Trusted Repositories

fossabot is intended to be used with code repositories that you trust and control. Security controls exist to protect the availability and integrity of the system and the confidentiality of any processed code, but the first line of defense is using fossabot with trusted application code.

fossabot's access to your code is bounded by the permissions you granted its source control integration (see Setup for the current permission list). If a new feature requires additional permissions, your organization administrator must review and approve the new permission grant before fossabot can use it.

Human Oversight

fossabot's output is always a proposal: a pull request, a review comment, or a check result. fossabot never merges code on its own. The engineer who reviews and merges a fossabot change retains responsibility for that change, the same as any other code they approve.

To keep this oversight enforced by your tooling rather than by convention, enable branch protection and required reviews on any repository fossabot writes to.

fossabot is intended to pass through your organization's existing change management policies. If your policy requires human review or sign off before changes are merged, fossabot dependency upgrades or code fixes should be reviewed accordingly.

fossabot code review takes in application context to provide an accurate assessment and attempts to remove as many false positives as possible. Engineers should always double check the assessment for correctness before merging code.

Out-of-Scope Uses

fossabot is not intended for high-risk uses under the EU AI Act. Specifically, fossabot is not intended to be:

• A substitute for a security review, legal review, or legal advice. Its security findings and compliance audit output are inputs to your own review processes, not a replacement for them.
• A component of a high-risk AI system under Annex III of the EU AI Act, such as systems used in employment, credit, or law enforcement decisions.
• Part of an unattended pipeline that merges its proposals automatically without human review.

fossabot SaaS Service

fossabot is a hosted service that is regularly updated with new features, bug fixes and security improvements. You cannot opt-out of the service's automatic upgrades.

Security controls protect the availability and integrity of the service and the confidentiality of your processed code. See System Architecture for how your code is isolated during analysis.

Material changes to data handling or retention, such as changes to what is stored after analysis or for how long, will be reflected in the Privacy Policy.

Material changes to fossabot's use of AI, such as a change of model provider or significant new AI-powered features, will be reflected in this documentation so that you can keep your own AI inventory current.

Configuration changes you make, such as enabling new integrations or expanding fossabot to additional repositories, expand the code and metadata that fossabot accesses and transmits for analysis, including transient processing by Anthropic as described in the Privacy Policy. Review these changes through your own change management process, as described above.

Decommission

Should you wish to decommission your usage of fossabot, you can revoke access to your code at any time and remove all integrations in your fossabot settings. Revoking access and removing integrations stop all future access to your code, but do not delete existing analysis results or related metadata, which are retained only as long as necessary to provide the service. Your source code is processed transiently and is not stored beyond what is required to complete each analysis, as described in the Privacy Policy.

You may request account or organization deletion via support ticket, and request deletion of Personal Data collected by fossabot by contacting privacy@fossa.com.

fossabot Private Saas Tenancy

fossabot is available to be hosted as a dedicated/private tenancy that is separated from other customers. These instances are upgraded by FOSSA engineers but customers have more control on when the upgrades take place.

Upon decommissioning, the entire tenancy is destroyed.