Terms of Service

Version 1.0 · Last updated 2026-10-20

In short: we analyse the files you submit, and we keep what we learn from them. We may publish and license that analysis data — hashes, scores, labels, statistics. Only submit files you have the right to submit. Submissions are not private, so never send us anything confidential.

1Acceptance

These Terms govern your use of this service (the “Service”). By submitting a file or URL, or by ticking the acceptance box on the submission form, you agree to these Terms. If you do not agree, do not submit anything.

2Definitions

Submission — any file, archive, URL or other content you send to the Service, and anything the Service retrieves from a URL you provide.
Derived Data — information generated by analysing a Submission that is not the Submission itself and contains no substantial reproduction of it: cryptographic and fuzzy hashes (such as SHA-256 and TLSH), entropy and other statistical measures, detection and classification labels, behavioural findings, extracted indicators of compromise, feature vectors, model outputs, scores, and aggregate analyses.
Transformed Output — machine-produced transformations of a Submission, such as deobfuscated or decompiled renderings, produced so that the Service can analyse it.

3The Service

The Service performs automated security analysis of Java archives and reports whether they exhibit characteristics associated with malicious behaviour. Results are automated, heuristic, and may be wrong in either direction. They are informational only, and are not a guarantee that a file is safe or unsafe. You remain responsible for your own security decisions.

4Rights you grant us

You grant us the following, separately and independently:

(a) To operate the Service A worldwide, royalty-free licence to store, copy, execute, decompile, deobfuscate, analyse and create Transformed Output from your Submission, for the purpose of providing the Service and improving its detection capability.

(b) To use Derived Data A perpetual, irrevocable, worldwide, royalty-free, sublicensable and transferable licence to create, store, use, reproduce, publish, distribute, license and sell Derived Data, including as part of research datasets, benchmarks, evaluations and commercial data products, and to use it to train, evaluate and improve machine-learning models. Derived Data is factual and statistical information about a Submission; it is not the Submission, and is not intended to reproduce any substantial part of it.

(c) To share Submissions with the security community A worldwide, royalty-free licence to share a Submission itself with security researchers, anti-malware vendors, computer emergency response teams and academic institutions, for the purpose of security research and protecting users. You may opt out of this paragraph (c) alone, without affecting (a) or (b), by emailing us the SHA-256 of the Submission — see section 13. Opting out of (c) does not withdraw (a) or (b).

You keep ownership of your Submission. Nothing here transfers copyright in it to us.

5What you promise us

For every Submission, you represent and warrant that:

you have the legal right to submit it and to grant the licences in section 4, or the submission is otherwise permitted by law (for example, as a lawful act of security research);
doing so does not breach any contract, licence, confidentiality obligation or applicable law;
it contains no personal data of other people beyond what is unavoidably embedded in the artefact you are analysing, and no information you are required to keep confidential;
you are not submitting it in order to have us distribute infringing material.

You agree to indemnify us against claims arising from a Submission that breaches these promises.

If you do not own a file, you cannot grant us rights to it that you do not hold. Where a Submission is third-party software, paragraph 4(b) is the operative grant, because Derived Data is our own factual analysis rather than a copy of your file.

6Submissions are not private

Do not submit anything confidential, proprietary or sensitive. Analysis results, including file hashes and detection findings, may be shown publicly on result pages, listed in recent-submission feeds, and made available through our API. Treat every Submission as public.

7Credentials and secrets

Malicious files frequently embed live credentials, webhook URLs, API tokens and similar secrets. If a Submission contains such material we may redact it, retain it for security analysis, report it to the relevant platform or provider for revocation, and include non-reversible representations of it (such as hashes) in Derived Data. If you believe a Submission exposed your own credentials, contact us and rotate them immediately.

8Research and dataset use

We build research datasets, benchmarks and evaluations from Derived Data, and we may publish or license these, including commercially. Where we publish Derived Data we aim to exclude personal data and anything that would reproduce a substantial part of a Submission. We do not sell your identity or contact details, and we do not require them in order to use the Service.

9Retention

We retain Submissions for as long as needed to operate and improve the Service, and we may archive them indefinitely for security research. Derived Data may be retained indefinitely, including after a Submission is deleted. Deleting a Submission does not withdraw the licence in section 4(b) in respect of Derived Data already created.

10Acceptable use

You must not:

use the Service to test, tune or verify malware so as to evade detection;
submit content that is unlawful to possess or transmit in your jurisdiction;
attack, overload, or attempt to gain unauthorised access to the Service;
scrape or resell the Service's output other than via our API terms.

11Disclaimer

The Service is provided “as is” and “as available”, without warranties of any kind, express or implied, including fitness for a particular purpose and accuracy of results. Detection is heuristic. A clean result does not mean a file is safe.

12Limitation of liability

To the fullest extent permitted by law, we are not liable for any indirect, incidental, consequential or special damages, or for any loss arising from reliance on an analysis result. Nothing here limits liability that cannot be limited by law.

13Contact and changes

To opt out of section 4(c), request deletion, or raise a concern, contact [email protected] quoting the SHA-256 of the Submission.

We may update these Terms. The version and the date they were last updated are shown at the top of this page. Changes apply to Submissions made after the date of that change; they do not retroactively alter the terms under which an earlier Submission was made.

Last reviewed 2026-10-20.