Terms of Service.

By accessing https://threat.blue, requesting a technical briefing, or entering into a Statement of Work or Order Form referencing these Terms, you agree to be bound by these Terms on behalf of the company, agency, or organization you represent (“Customer”).

Where Customer and EarlyBird AI, LLC execute a separate Master Services Agreement (“MSA”), Rules of Engagement (“RoE”), or mutual Non-Disclosure Agreement (“NDA”), that signed agreement controls in the event of a conflict with these Terms. Data handling for Customer artifacts is further governed by our Privacy Policy and Data Processing Addendum.

Threat.Blue provides autonomous vulnerability discovery, isolated proof-of-concept verification, and remediation engineering strictly for authorized defenders. Customer represents, warrants, and covenants that:

• Right to authorize: Customer owns, maintains, or holds explicit written legal authority to submit every source repository, binary artifact, firmware image, container, or dependency scope provided to Threat.Blue for security analysis.
• Defensive use only: Findings, reproduction inputs, and technical advisories delivered by Threat.Blue will be used solely to remediate vulnerabilities, harden software, or conduct lawful Coordinated Vulnerability Disclosure.
• No prohibited targets or activities: Customer shall never request or use Threat.Blue deliverables to attack, disrupt, exfiltrate data from, or gain unauthorized access to any third-party network, computer system, or service in violation of the Computer Fraud and Abuse Act (18 U.S.C. § 1030) or equivalent applicable law.

Threat.Blue reserves the right to refuse, suspend, or terminate any briefing or engagement immediately if authorization cannot be independently verified or if dual-use safety guardrails in our Security & Governance Charter are implicated.

Customer code & patches

Customer retains all right, title, and interest in and to Customer’s source code, binaries, firmware, test suites, and confidential materials (“Customer Materials”). Upon payment of applicable engagement fees (or upon delivery for no-fee coordinated disclosures), Threat.Blue assigns to Customer (or licenses under the target repository’s existing open-source license, as applicable) all right, title, and interest in source-code patches, pull requests, and vulnerability reports authored specifically for Customer’s code.

Threat.Blue platform & zero model training

EarlyBird AI, LLC retains all right, title, and interest in the Threat.Blue analysis engine, harnesses, tooling, methodologies, and pre-existing intellectual property. Threat.Blue does not use Customer Materials, proprietary binaries, or engagement findings to train or fine-tune foundation models.

Threat.Blue validates candidate patches against isolated builds and Customer-supplied test suites before presenting a diff or pull request. However, Customer’s engineering team retains sole responsibility for reviewing, testing, approving, and deploying any code change into staging or production environments.

Unpatched vulnerability details, Customer Materials, and engagement scopes constitute strictly confidential information. Threat.Blue restricts access to authorized security personnel on a least-privilege need-to-know basis, executes analysis in single-tenant ephemeral sandboxes, and never publicly discloses findings in proprietary Customer code without Customer’s express written consent. Upstream open-source component flaws are handled under the Coordinated Vulnerability Disclosure process described at threat.blue/security.

Security research reduces risk by surfacing reachable defects; however, no automated or manual audit can guarantee that complex software is free of all vulnerabilities. Except as expressly stated in a signed MSA, the website and services are provided “as is” without implied warranties of merchantability, fitness for a particular purpose, or error-free operation.

To the maximum extent permitted by law, neither party shall be liable for indirect, incidental, special, consequential, or punitive damages, and Threat.Blue’s aggregate liability arising out of these Terms shall not exceed the greater of the fees paid by Customer to EarlyBird AI, LLC for the applicable Threat.Blue services in the twelve (12) months preceding the claim or one thousand US dollars ($1,000).

These Terms are governed by the laws of the State of Delaware and applicable federal laws of the United States, without regard to conflict-of-laws rules. Export-controlled technical data may not be submitted without prior written notice and compliance coordination with EarlyBird AI, LLC.

Legal and compliance notices may be sent to EarlyBird AI, LLC d/b/a Threat.Blue at security@threat.blue or via our parent organization at oneearlybird.ai.