Terms · Contribution terms
Version 2026-10
Superseded by 2026-11. This page stays as it is, for anyone who accepted this version.
SHA-256 of the text: bb0d3024ddd4af5bbe76ec55c749455fcff1be168c33c53a9fb99d6a000d8b42
nox's tests pin this hash, so a release cannot change these words without changing the version. To check the text your nox shows, nox intel consent show | shasum -a 256 prints the same hash when your nox carries this version.
NOX Intelligence contribution terms, version 2026-10
Contribution is optional. Scanning, and asking NOX Intelligence for
advisories, work the same with it off. It stays off until you turn it on
(scan.intelligence.contribute: true) AND accept these terms on this machine.
What is sent
For each vulnerable dependency a scan finds, one observation containing only
the fields printed by "nox intel allowlist": a fingerprint, the package
ecosystem, name and affected version range, the weakness class, the nox rule
id, an opaque id for this installation, a timestamp, the nox version, the
terms version you accepted, and a hash that lets only you erase your id.
What is never sent
Source code, file contents, file paths, repository names, code snippets,
secrets, prompts, model output, or findings from any rule other than
dependency vulnerabilities. Your reporter id is derived from a secret that
stays on this machine and reveals nothing about you.
What the service does with it
It counts how many distinct installations reported the same issue, and may
publish a record derived from many reports. A published record never contains
a reporter id. Nothing is published without review by a person.
How long identifiers are kept
By default the service removes reporter ids from unpublished reports 90 days
after the last activity. A removed report still counts as having been made,
but is no longer linked to you. A self-hosted service may use another period.
How to erase and withdraw
"nox intel forget" removes your reporter id from every report on the service
(including published ones) and turns contribution off on this machine.
"nox intel consent withdraw" turns it off without contacting the service.
If these terms change, contribution pauses until you accept the new version.