Compliance GRC Console (containerised)

The execution surface of the delivery was reviewed item by item: the files we added were read line by line (compose.quickstart.yaml, Dockerfile.quickstart, scripts/quickstart/init-env.sh) — both published ports (the console on 8080 and the built-in mailbox on 8025) are bound to 127.0.0.1, and the database, the object storage and the headless browser communicate only on the compose internal network; the four sets of keys needed to start are generated at random by the script and left empty in the environment variable template. The credentials for the database and the object storage, on the other hand, are fixed values in the template, the same set in every delivery, and the template itself notes that they are safe only on the premise that those two ports are not published externally. init-env.sh guards against overwriting: replacing the encryption key would make existing data impossible to decrypt, so it refuses to run once it detects an existing file. Upstream's Go / TypeScript source was not read file by file; the basis here is the MIT licence, container isolation and the evaluation-configuration warning stated plainly in the quick-start guide.

The scripts that run on the buyer's delivery path were each examined: init-env.sh was written by us (read line by line: openssl produces four sets of keys, it writes one .env.quickstart only, and it guards against overwriting); the build goes through Dockerfile.quickstart (read line by line: go mod download, npm ci, merging the GraphQL schema and go generate, and apt installing run-time dependencies, with no shape of the form "download and feed straight into a shell"); the database migration runs automatically when the container starts, along upstream's own official path. The optional demonstration data script scripts/demo-seed/seed.mjs creates its data through the console's own API and creates a demonstration account with administrative privileges, whose credentials are written in that script and in the quick-start guide.

This product is a frozen snapshot and does not follow upstream: upstream's source is pinned at the commit 5c5f60d5 as it stood at the time of vetting (see the evidence link), and the product repository consists of that snapshot plus the commits of our own work. At the time of vetting the upstream repository was public and not archived.

SPDX:LicenseRef-99LL-Product

Upstream's LICENSE was checked word for word (the evidence link points at the file itself at the pinned commit, and it was compared against the same file inside the product repository and found consistent): the standard full text of the MIT licence, Copyright (c) 2025 Probo Inc — permitting commercial use, modification, derivative works, redistribution and sale, with the obligation of retaining the copyright notice and the full text of the licence (LICENSE, THIRD-PARTY-NOTICES and ATTRIBUTION.md are delivered with the zip). This is not a judgement made from GitHub's licence field. For the product as a whole, the 99LL product licence template is attached: upstream's LICENSE and THIRD-PARTY-NOTICES are kept as they stand, and LICENSE-99LL.md is placed alongside them as the sale and liability terms for the parts we added, with spdx recorded as LicenseRef-99LL-Product.

What is recorded here is the declaration surface, not the result of a scan: the Go dependencies are declared in go.mod / go.sum and the front end is locked by package-lock.json, with the packages themselves fetched from their own registries when the buyer builds; the run-time base images (postgres, seaweedfs, chromedp headless-shell, mailpit) are likewise pulled from registries by the buyer. The licences of those dependency trees were not scanned package by package. The third-party material that does enter the tree under version control and is distributed with the zip is recorded in ATTRIBUTION.md as three items: two datasets (disposable-email-domains and country-ip-blocks, both CC0-1.0) and one font (Noto Sans TC, OFL-1.1), each with its own licence file kept in its own directory. The THIRD-PARTY-NOTICES upstream maintains is kept with the delivery as it stands.