Terms of use

Last updated: July 20, 2026

OpenSourceMalware exists to help security professionals research threats, protect their organizations, and respond to incidents faster. These terms explain what you can do with our data, what requires a separate agreement, and what is never allowed.

By creating an account or using this service, you confirm that you have read and understood these terms and agree to be bound by them.

If you are using OSM on behalf of an organization, you are also confirming that you have the authority to bind that organization to these terms.

1. What You Can Do

You are welcome to use free or licensed OpenSourceMalware (OSM) data for non-commercial purposes. Here are some great examples of acceptable usage!

Research

  • Studying malware trends, threat actors, campaigns, or attack techniques
  • Academic or independent security research

Protecting your own organization

  • Using threat records to investigate whether your organization has been exposed to a known threat
  • Checking whether a software package is malicious before using it in your own projects
  • Building an internal platform to serve internal customers (e.g. analysts)
  • Feeding OSM data into your internal tools, processes, or pipelines to help your security team work more effectively
  • Responding to a security incident inside your own organization
  • Producing internal reports, briefings, or executive summaries that draw on OSM data (including sharing those with leadership, legal counsel, or your cyber insurer in connection with an incident)

Using the API to power these activities is encouraged, including automated lookups as part of your security workflows. Large-scale or bulk API use to sweep your own environment retroactively (for example, during an active incident) is also permitted for internal use. The prohibition in Section 3 applies to copying our database for external redistribution, not to using the API at scale for your own security operations. See Section 4 for more on API use.

2. Requires Explicit Permission and a License

If you use OSM data to build or deliver something that provides value to people outside your organization, you need an Enterprise License Agreement before you begin.

This includes:

  • Building a commercial product that uses OSM data as a source — for example, a threat intelligence platform (TIP/CTI), an AppSec or ASPM tool, a vulnerability management product, a security dashboard, or any other product where OSM data improves what you deliver to your customers
  • Offering a managed security service (MSSP), consulting service, or incident response service where OSM data is part of what your clients receive
  • Any other situation where OSM data contributes to value you provide to a third party
  • Incorporating OSM data into a separate database or dataset that you share or sell
  • Using OSM data to train machine learning or AI models for commercial purposes

In simple terms: if someone outside your organization benefits from OSM data as part of something you sell or deliver, that is commercial use and requires a license.

To discuss an Enterprise License, contact us via the contact form.

3. What Is Never Allowed

Regardless of your subscription tier, no user may harvest or stockpile OSM data beyond what the API is designed to provide (see section 4). This includes the use of automated tools (bots, scrapers, crawlers).

4. Using the API

Using OpenSourceMalware APIs as part of your legitimate security work is encouraged. Automated lookups, integrations with your internal tools, and pulling data into your workflows are all examples of intended API use.

What is not allowed is using automated tools to systematically harvest and copy our entire dataset — for example, crawling every record in our database to build your own copy of it. This is true regardless of your subscription tier.

If you are unsure whether your planned API use falls within these guidelines, contact us before you build.

5. Data Ownership and License

All data provided by OpenSourceMalware remains the exclusive property of OpenSourceMalware. By creating an account and using this service, you are granted a limited, non-exclusive, non-transferable, revocable license to access and use the data for the purposes described in Section 1.

This license does not include the right to redistribute, resell, sublicense, or use the data for commercial purposes as described in Sections 2 and 3.

6. Enforcement

If you violate these terms:

  • Your access to the service may be terminated immediately
  • Your license to use OSM data is automatically revoked
  • You may be held liable for damages, including any profits derived from unauthorized use

We would rather work with users to resolve unintentional violations than take enforcement action. If you think you may have crossed a line, especially if it was unintentional, please reach out via the contact form.

7. Reporting Violations

If you become aware of someone using OSM data in a way that violates these terms, please let us know via the contact form.