Last updated: 2026-08-16. Governing law: Israel.

Open-Source Licenses and Attributions

The EyalSec / es2 Service and the EyalSec agents (es-python, es-chromium, es-c, es-cpp, es-rust, es-node, es-solidity, es-bash and es-php) incorporate open-source software. This page is the attribution notice that the licenses of those components require us to provide with the distribution. It summarizes the headline components and reproduces the notices that must be reproduced. It does not replace the license texts, which govern.

Published by Eyal Gabay, trading as "EyalSec", sole proprietor (osek murshe) no. 211868450, Israel. Requests under any of the source-availability offers below go to eyal@eyalsec.com.

1. es-python and CPython

es-python is a modified version of CPython 3.9, 3.10, 3.11, 3.12, 3.13 or 3.14, according to the version selected for the machine. CPython is licensed under the Python Software Foundation (PSF) License Agreement, a permissive, GPL-compatible license. Our modifications add security instrumentation; the underlying interpreter remains CPython under the PSF License. The PSF License and copyright notices are retained as required.

2. es-chromium and the Chromium open-source project

es-chromium is a modified version of the Chromium open-source project. Chromium is published by The Chromium Authors under the BSD 3-Clause License, and bundles a large number of further third-party components under their own licenses. Our modifications add security instrumentation and EyalSec branding; the underlying browser remains Chromium under its own licenses.

es-chromium is not Google Chrome, is not produced, endorsed or supported by Google, and must not be presented as either. See the trademark notice in Section 11.

Chromium copyright notice and license

Copyright 2015 The Chromium Authors. All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

   * Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
   * Neither the name of Google LLC nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Components bundled inside es-chromium

A browser bundles hundreds of third-party components. The headline ones, and the license families they fall under, are:

| Component | Role | License (summary) | |-----------|------|-------------------| | Chromium (including its rendering and JavaScript engines) | The browser itself | BSD 3-Clause | | BoringSSL | TLS and cryptography | Mixed: OpenSSL License, ISC, MIT, BSD | | FFmpeg | Audio and video decoding | LGPL-2.1-or-later (see the source offer below) | | libvpx, dav1d, libaom, Opus, libwebp, Skia, libjpeg-turbo, libpng, zlib, Brotli, protobuf, ANGLE, libyuv | Media, imaging, graphics, compression, serialization | Predominantly BSD 2/3-Clause and MIT | | ICU | Internationalization, locale and Unicode data | Unicode License / ICU License (permissive) | | SQLite | Local storage | Public domain | | HarfBuzz, FreeType | Text shaping and font rendering | MIT (HarfBuzz); FreeType License (BSD-style) or GPL-2.0, at our option, for FreeType | | libxml2, libxslt, Expat | XML parsing and transformation | MIT | | Fontconfig and other platform integration libraries | System integration | MIT and BSD-style |

This table is a summary, not the attribution record. The complete, authoritative list of every third-party component in a given es-chromium release, with its full license text, is the Chromium credits document for the revision that release is built from. The revision is recorded in the BUILD_INFO.txt file inside each published es-chromium tarball, and the credits for any revision are published by the Chromium project. A copy of the complete credits document for the revision you are running is available on request at eyal@eyalsec.com.

Copyleft in es-chromium: FFmpeg (LGPL) and your relinking right

es-chromium includes FFmpeg, which is licensed under the GNU Lesser General Public License, version 2.1 or later. EyalSec makes no modifications to FFmpeg.

Under the LGPL you are entitled to the complete corresponding source code for the FFmpeg components, and to the means to modify them and relink them into the software. We hereby make a written offer, valid for at least three (3) years from the date you received the software, to provide, on request at eyal@eyalsec.com, the complete corresponding source code for the LGPL-licensed components in your es-chromium release, and the object files or other material necessary to relink a modified version of those components, at no more than our reasonable cost of distribution.

Codecs and patents. es-chromium is built with the open codec set. It does not include the proprietary codecs (for example H.264 and AAC) that a Google-branded Chrome build ships, and it does not include a digital rights management module for protected media. Some patented codecs are therefore unavailable in es-chromium, and no third-party codec patent license is passed to you with it.

3. es-c and es-cpp

es-c and es-cpp redistribute no third-party software. The published artifacts contain only EyalSec's own instrumentation plugins, runtime libraries, headers, compiler-driver scripts and detector registries. They load into, and build against, the compiler already installed on your own machine; no compiler is shipped with them.

The plugins are built against the LLVM/Clang compiler infrastructure, which is licensed under the Apache License 2.0 with the LLVM exception. That exception exists precisely to let a plugin or a compiled output be distributed without inheriting a notice obligation, so no LLVM attribution is required for the artifacts we publish, and none is included.

If we later publish an es-c or es-cpp artifact that bundles a compiler, that artifact does redistribute LLVM/Clang, and the Apache-2.0-with-LLVM-exception attribution and NOTICE requirements will apply to it. This page will be updated before any such artifact is published.

4. es-rust and the Rust toolchain

es-rust is a modified version of the Rust programming language toolchain. Rust is published by The Rust Project Developers and is dual-licensed under the MIT License and the Apache License 2.0, at your option. Our modifications add security instrumentation; the underlying toolchain and standard library remain Rust under its own licenses, and the license and copyright notices are retained as required.

Copyright (c) The Rust Project Developers

Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.

The es-rust distribution does not include the Rust standard library source component. Rust source is publicly available from the Rust project (Section 12).

5. es-node

es-node is a modified version of the Node.js runtime. Node.js is published under the MIT License and bundles further third-party components, including its JavaScript engine (BSD 3-Clause), libuv (MIT), OpenSSL (Apache-2.0), zlib, llhttp (MIT) and c-ares (MIT). Our modifications add security instrumentation; the underlying runtime remains Node.js under its own licenses, and the license and copyright notices are retained as required. The complete attribution set for a Node.js release is its bundled LICENSE file, a copy of which is available on request at eyal@eyalsec.com.

6. es-solidity and the Solidity compiler

es-solidity is a modified version of the Solidity compiler (solc).

The Solidity compiler is licensed under the GNU General Public License, version 3 (GPL-3.0). This is a strong copyleft license. Unlike every other component on this page, distributing a modified solc obliges the distributor to make the complete corresponding source code of the modified work available to each recipient under the GPL-3.0, and those recipients are then free to use, modify and redistribute it on the same terms.

es-solidity is not currently distributed to customers. No es-solidity artifact is published or served by the Service at the date of this page, so no GPL-3.0 distribution has occurred and no source-disclosure obligation has yet arisen.

Before any es-solidity artifact is distributed, EyalSec will either publish the complete corresponding source of the modified compiler under the GPL-3.0, as that license requires, or will not distribute it. If and when es-solidity ships, this page will be updated to carry the GPL-3.0 notice and the source offer in force at that time. Requests may be sent to eyal@eyalsec.com.

Note also that es-solidity produces development builds only: a contract compiled with it is instrumented for testing, its gas costs and code hash differ from a production build, and it must never be deployed to a public network. See Section 10(b) of the Terms.

7. es-bash and the GNU Bourne-Again Shell

es-bash is a modified version of GNU Bash. Bash is published under the GNU General Public License, version 3 or later (GPL-3.0-or-later).

EyalSec does not distribute a modified Bash binary, and does not distribute Bash. What we make available is a source bundle: the unmodified upstream Bash release as published by the GNU Project, our patch series, and our own instrumentation sources. The customer's own machine compiles those into a binary for that machine's own use.

The consequences, stated plainly because they are the point of that arrangement:

You receive the complete corresponding source, because the bundle is source. Nothing about the modified shell is withheld from the party running it.
The upstream Bash source is unmodified in the bundle and is separately available from the GNU Project at https://ftp.gnu.org/gnu/bash/. The bundle records the exact release and its SHA-256, and the build refuses to proceed if the checksum does not match.
If you convey the compiled binary to anyone else, GPL-3.0-or-later applies to that act and to the combined work, and the obligations are yours as the conveying party. Building it for your own use is not conveying.
Our instrumentation sources are provided under the same terms as the combined work they are built into.

Bash is a project of the GNU Project and the Free Software Foundation. EyalSec is not affiliated with, endorsed by, or sponsored by either. See the trademark notice in Section 11.

Review note (2026-08-26): this section states the licensing basis of es-bash's entire delivery model and has not yet been reviewed by counsel. es-bash is not offered to customers at the date of this page.

8. es-php and the PHP runtime

es-php is a modified version of PHP. PHP is published under the PHP License, version 3.01, and the Zend Engine it contains under the Zend Engine License, version 2.00. Both are permissive, BSD-style licences.

EyalSec distributes a compiled binary, and may do so without conveying source, because neither licence requires it. What both licences do require, and what we honour:

The copyright notices and the licence text travel with the artifact.
Nothing here implies that the PHP Group endorses, sponsors or is affiliated with EyalSec. It does not. See the trademark notice in Section 11.

OPEN ISSUE: the product name. Clause 4 of the PHP License 3.01 reads:

Products derived from this software may not be called "PHP", nor may "PHP" appear in their name, without prior written permission from group@php.net.

The name es-php contains "PHP", and this product is derived from PHP. On the plain text of that clause the name requires prior written permission from the PHP Group, which has not been sought or obtained. The clause itself suggests the compliant alternative form ("Foo for PHP" rather than "PHP Foo"), so a name of the shape " for PHP" would not need permission.

This is recorded rather than resolved. It is a naming decision, not an engineering one, and it must be settled (by obtaining permission or by renaming) before any es-php artifact or entitlement is offered to a customer. Nothing on this page should be read as a representation that the current name is cleared.

The upstream PHP source is unmodified in our build inputs and is separately available from the PHP Group at https://www.php.net/distributions/. Our build records the exact release and its SHA-256 and refuses to proceed if the checksum does not match.

GNU Readline is deliberately excluded from the build. It is the one GPL-licensed component in a default PHP configuration, and including it in a binary artifact would attach a source-conveyance obligation to the whole of it. The cost is interactive line editing in the interactive prompt, which a served application does not use.

This is the mirror image of es-bash in Section 7, and the contrast is the clearest illustration of how these decisions are made: bash is GPL-3.0, so es-bash conveys source and no binary; PHP is permissively licensed, so es-php conveys a binary and no source. Neither is a preference. Each follows its upstream's licence.

Review note (2026-08-27): this section states the licensing basis of es-php's delivery model and has not yet been reviewed by counsel. No es-php artifact is served to customers at the date of this page.

9. The es2 server and dashboard

| Component | Role | License (summary) | |-----------|------|-------------------| | Go modules (chi router, gorilla/sessions, pgx, AWS SDK for Go, goldmark, and others) | The es2 server: routing, sessions, database access, cloud integration, Markdown rendering | Predominantly MIT / BSD / Apache-2.0 | | PostgreSQL | Database | PostgreSQL License (permissive, BSD-style) | | Bootstrap | Front-end styling of the web dashboard | MIT License | | OpenSSL | TLS and cryptography | Apache License 2.0 (OpenSSL 3.x) |

10. Instrumented data-store drivers bundled with es-python

| Component | Role | License (summary) | |-----------|------|-------------------| | psycopg2, psycopg 3 + psycopg_c | PostgreSQL access | LGPL-3.0-or-later with an OpenSSL linking exception (psycopg2); LGPL-3.0-only (psycopg 3, psycopg_c) (copyleft) | | mysqlclient | MySQL access | GPL-2.0-or-later (copyleft) | | mariadb | MariaDB access | LGPL-2.1 (copyleft) | | oracledb | Oracle access | UPL-1.0 OR Apache-2.0 | | python-ldap | LDAP access | Python-style (PSF-style) license | | Cython | Building the compiled native extension bundled with es-python | Apache License 2.0 | | pip / setuptools / wheel | Python packaging tooling bootstrapped with es-python | MIT / MIT / MIT-style |

Note on copyleft components. Unlike the interpreter itself, the bundled data-store drivers are not all permissively licensed. EyalSec's modifications to those drivers are limited to adding an injection detection point on the query string (or, for python-ldap, on the LDAP search filter). The corresponding source for each modified driver is available on request at eyal@eyalsec.com, as their licenses require, and this constitutes a written offer valid for at least three (3) years from the date you received the software.

Other packages bundled with es-python

es-python also bundles the following packages. Some are built with EyalSec instrumentation and some are shipped unmodified; the exact set can vary with the Python version selected. Each carries its own license file.

| Component | License (summary) | |-----------|-------------------| | requests, kafka-python, aiohttp, pymongo, msgpack | Apache License 2.0 (aiohttp: Apache-2.0 and MIT) | | urllib3, h11, httptools, PyYAML, Brotli, hiredis | MIT | | httpx, uvicorn, pika, protobuf, lxml, numpy, ujson, zstandard | BSD-style (predominantly BSD 3-Clause) | | uvloop, orjson | MIT or Apache-2.0, at your option | | cryptography | Apache-2.0 or BSD 3-Clause, at your option |

11. Trademark non-endorsement

"Python" and the Python logos are trademarks of the Python Software Foundation (PSF). Use of "Python", including in the name "es-python", is nominative, to identify the underlying interpreter; it does not imply sponsorship, affiliation, or endorsement by the PSF.
"Chromium", "Chrome", "Google" and their logos are trademarks of Google LLC. The Chromium project's code is BSD-licensed; Google's trademarks are not licensed with it. Use of "Chromium", including in the name "es-chromium", is nominative, to identify the underlying open-source project. es-chromium is not Google Chrome and is neither produced, endorsed, sponsored nor supported by Google. es-chromium carries EyalSec branding, not Chromium's or Google's.
"LLVM" and "Clang" are trademarks of the LLVM Foundation. Used nominatively to identify the compiler infrastructure es-c and es-cpp build against; no endorsement or affiliation is implied.
"Rust", "Cargo" and the Rust logos are trademarks of the Rust Foundation. Used nominatively; no endorsement or affiliation is implied. Use of the product name "es-rust" should be confirmed against the Rust Foundation's trademark policy.
"Node.js" is a trademark of the OpenJS Foundation. Used nominatively; no endorsement or affiliation is implied.
"Solidity" and "Ethereum" are used nominatively to identify the language and platform es-solidity targets; no endorsement or affiliation is implied.
"PHP" is a trademark of the PHP Group. Beyond trademark, the PHP License 3.01 carries an express naming clause (see Section 8): "PHP" may not appear in the name of a derived product without prior written permission. The name es-php is not cleared against that clause. No endorsement, sponsorship or affiliation by the PHP Group is implied or claimed.
"OpenSSL" is a trademark of the OpenSSL Software Foundation / OpenSSL project; used descriptively, no endorsement implied.
"PostgreSQL", "MySQL", "MariaDB", "Oracle" and other product and company names are the trademarks of their respective owners; their mention identifies compatibility and does not imply endorsement.

12. Source availability, in one place

For every component whose license requires that source be offered, and for the PSF-licensed CPython base, the BSD-licensed Chromium base, the MIT/Apache-2.0 Rust base and the MIT Node.js base, corresponding source or a written offer is available on request at eyal@eyalsec.com. This offer is valid for at least three (3) years from the date you received the software. CPython, Chromium, Rust and Node.js source are also publicly available from their respective projects.

The GPL-3.0 obligation attaching to es-solidity is separate and stronger than this offer; see Section 6.

es-bash needs no such offer, because what is delivered is source rather than a binary: see Section 7.

es-php needs no such offer either, for the opposite reason: the PHP License 3.01 and the Zend Engine License are permissive and impose no source-conveyance obligation on a binary. See Section 8.

13. Warranty

Open-source components are provided by their licensors under their own terms and, in most cases, without warranty of any kind. Nothing on this page or in the Terms of Service adds a warranty or an indemnity from EyalSec in respect of an open-source component beyond what Section 10(e) of the Terms provides.

Third-Party Licenses