LAST UPDATED 9 NOVEMBER 2026

Terms of service

These terms apply to the hosted PkgFire service at pkgfire.org, the pkgfire command-line tool when it talks to that service, and PkgFire's integrations with GitHub, Forgejo and Gitea. By creating an account or using the service you accept them. If you use PkgFire for an organisation, you accept them on its behalf and confirm that you may.

Who provides PkgFire

PkgFire is provided by Caio Ricciuti, a sole trader (autónomo) established in Spain. His tax id and postal address are on the legal notice. Email: me@caioricciuti.com, for anything about these terms, billing, refunds or your account.

What PkgFire does

PkgFire checks software dependencies before they are installed and reports a verdict, ALLOW, WARN or BLOCK, with the reasons for it. It does this from the dependency information you or your integrations send (see what is uploaded), public advisory data and its own analysis of the published packages. What it checks is described in the documentation.

The service changes over time: checks are added, improved and occasionally retired. A change that materially reduces what a paid credit buys is announced at least 30 days ahead by email.

Accounts

  • You need an account to use the service. You sign in with an email address you control, and you are responsible for what is done with your account, its API keys and its sessions. Keep keys secret, and revoke any key you suspect has leaked.
  • An account can have several members. Owners decide who belongs to it, buy its credits and connect its integrations. Everyone in an account can see its projects, scans and members.
  • While sign-up is by invitation, PkgFire decides who is given an account. Being on the waitlist is not a promise of one.
  • You can stop using PkgFire at any time. To delete a personal account and its data, write to the address above; what happens to your data is described in the privacy notice.
  • PkgFire may suspend or close an account that breaks these terms. Except where the breach is serious or the law requires otherwise, you are told first, with the reason, and given a reasonable chance to put it right.

Credits

Checks are paid for with prepaid credits. There is no subscription and nothing renews.

  • What a check costs. One credit for each package in the dependency set checked, whether or not its result was already cached. The full rules, with prices, are on the pricing page, which forms part of these terms. A scan that fails or is cancelled costs nothing.
  • Free credits. Personal accounts are topped up to a free monthly allowance, currently 5,000 credits. Free credits have no cash value, cannot be transferred or refunded, and the allowance may be changed or ended with 30 days' notice on the pricing page.
  • Paid credits. Bought in packs, at the price shown when you buy, which includes VAT. They belong to the account that bought them and are shared by its members. Paid credits expire 12 months after the purchase that bought them. Credits are spent oldest first, so what expires is only what is left of a purchase a year after it. Unused credits are not refunded when they expire, or when an account or organisation is closed.
  • Spending limits. An account can cap what automatic checks, such as pull request checks and scheduled re-scans, may spend per check and per day. A check that cannot reserve its credits does not run and never reports a pass.
  • Payment. Payments are handled by a payment provider; card details go to the provider and never reach PkgFire. Credits are added only once the payment is confirmed.

Refunds and your right to withdraw

If you are a consumer in the EU, you may withdraw from a purchase of credits within 14 days of buying them, without giving a reason, by writing to the address above. Because credits are used as you go, you get back the price of the credits from that purchase that you have not used. Credits you used during those 14 days are paid for in proportion, as Spanish law provides (Real Decreto Legislativo 1/2007, art. 108). The refund goes to the original payment method within 14 days of your request.

Apart from that, purchases are final: unused or expired credits are not refunded. For everyone, if a technical fault on PkgFire's side charged credits for a check that did not happen, or charged twice for one, write to the address above and the credits are restored.

If a payment is refunded or reversed, the credits it bought are removed. If some were already spent, the account owes them back, and checks pause until the balance is settled.

Acceptable use

Use PkgFire to check dependencies you use or are evaluating. Do not:

  • try to get around the credit system, the rate limits or the abuse limits, or create accounts to multiply the free allowance;
  • submit data you have no right to submit, or other people's personal data beyond what the service needs;
  • use the service to attack, probe or overload PkgFire or anyone else, or to develop or test malware or ways to evade detection;
  • probe PkgFire's security except as the security policy allows;
  • resell the service, or offer verdicts from it as a service of your own, without written agreement;
  • scrape the service or copy its analysis in bulk.

Verdicts are an assessment, not a guarantee

PkgFire's verdicts are automated assessments, made from the information available when the check ran. They are offered to help you decide, not to decide for you.

  • ALLOW is not a promise that a package is safe. No analysis finds every malicious or vulnerable package. A careful attacker can write code that passes every check, an advisory can be published after the check, and a package's behaviour can depend on things no static analysis sees. You remain responsible for what you install and run.
  • WARN and BLOCK are not findings about a person. A verdict describes a package version as PkgFire saw it, often by its resemblance to the shape of known attacks. It is not a statement that the package's authors acted maliciously.
  • What PkgFire reports comes partly from public sources it does not control. It is passed on as received, with its source, and can be wrong.

To the extent the law allows, the service is provided as it is and as available, without any warranty that it is uninterrupted, error-free, or fit for a purpose it does not describe. Nothing in this section limits the rights consumers have by law when a service is not provided as described.

Liability

PkgFire is liable without limit for damage caused intentionally or by gross negligence, for death or personal injury, and wherever the law does not allow liability to be limited.

Otherwise, and to the extent the law allows:

  • PkgFire is not liable for indirect or consequential loss, such as lost profit, lost data that you could have backed up, or the cost of an incident a check did not prevent.
  • PkgFire's total liability for everything arising from the service in any twelve months is limited to what the account paid PkgFire in those twelve months, or 100 euros if that is more.

If you are a consumer, these limits apply only as far as Spanish and EU consumer law permits.

Your content

Your dependency lists, project names, policies and scan history remain yours. You give PkgFire the right to process them to provide the service to you. The analysis of a public package version, which describes the package and not you, is shared across all accounts so a package is not analysed twice.

PkgFire does not use your data for advertising, does not sell it, and does not send it to any AI service. Personal data is handled as the privacy notice describes.

Changes to these terms

These terms may change. A change that affects you materially is emailed to account owners at least 30 days before it applies, and you can stop using the service and withdraw unused paid credits under the refund rules above before it does. The date at the top of this page is the date of the current version.

Governing law and disputes

These terms are governed by Spanish law. If you are a consumer living in the EU, you also keep the protection of the mandatory consumer law of the country where you live, and you may bring a claim before the courts of your place of residence. Otherwise, the courts of Alicante, Spain, have jurisdiction.

If something goes wrong, write to me@caioricciuti.com first: most problems are solved faster that way. Consumers in Spain can also turn to the consumer arbitration system (Sistema Arbitral de Consumo) or their regional consumer authority.