Terms of Service

The short version: VulnRap is a free tool built by security practitioners for security practitioners. There are no hidden motives. Here are the ground rules.

How This Gets Funded

VulnRap is directly funded by REMEDiS Security and COMPLiTT. There are no investors, no venture capital, no advertising revenue, and no plans to monetize user data.

We built this because we work in PSIRT and vulnerability disclosure ourselves. We got tired of wading through AI-generated garbage and duplicate reports. We figured if we were frustrated, other people were too. So we built the tool we wished existed and made it free.

The project is open source. If it turns out we can not keep funding it forever, the code is there for anyone to run their own instance.

What You Are Agreeing To

By using VulnRap, you agree that:

You will not upload content that you do not have the right to share. If a report contains proprietary information from a private vulnerability program, make sure your program's rules allow external analysis tools.
Reports submitted in "Share with the community" mode will be auto-redacted and made available for similarity comparison by other users. That is the whole point — this only works if people contribute.
You will not use automated tools to flood the platform. We have per-minute rate limits (for example 10 submissions per minute per IP) and we will block abusive traffic.
You understand that auto-redaction is regex-based and not perfect. If your report contains sensitive information in unusual formats, the redactor might miss it. When in doubt, pre-sanitize your report before uploading.
You will not use VulnRap to harass, track, or de-anonymize other users.

What We Promise

We will never sell, license, or share your data with third parties, except the verification lookups and AI-assisted analysis described in our Privacy Policy. Not advertisers, not data brokers, not anyone.
We will never add tracking, analytics cookies, or advertising to VulnRap.
We will never require user accounts, email verification, or any form of identification.
We will keep the core functionality free. If we ever add premium features, the analysis, comparison, and redaction tools will remain free and open.
We will keep the project open source so anyone can verify these claims or run their own instance.

Disclaimers

No guarantees. VulnRap is provided as-is. Slop detection is heuristic-based and can produce false positives and false negatives. A low slop score does not guarantee a report is legitimate. A high score does not guarantee it is AI-generated.
Not legal advice. VulnRap's analysis is a technical assessment, not a legal determination of originality, plagiarism, or fraud.
No liability. We are not responsible for decisions made based on VulnRap's analysis. If you reject a valid report because of a high slop score, or accept a fraudulent one because of a low score, that is on you.
Uptime. We do our best to keep VulnRap available, but we do not guarantee uptime. This is a community tool, not a paid SaaS product with an SLA.
Data persistence. We may need to reset the database for major upgrades. While we will try to preserve data when possible, do not treat VulnRap as permanent storage for your reports.

Content Removal

If you submitted a report and want it removed, email us at remedisllc@gmail.com with the report ID or content hash. We will remove it. No questions asked.

If you believe someone uploaded content that violates your rights, contact us with the details and we will investigate.

Changes to These Terms

If we change these terms, we will update this page. We are not going to bury changes in fine print or send you emails you did not ask for (we do not have your email anyway).

Last updated: April 2026