Open-source licences and third-party notices
The open core of Bounty Operator is MIT-licensed. The pages your browser loads contain no third-party code. The Worker uses the open-source packages listed here. The MCP server has no dependencies.
Bounty Operator: MIT
The site, the review engine with its three core profiles, the free tools, the MCP server and the command-line kit are released under the MIT licence. The source is on GitHub. The gauntlet stages and the panel cross-examination run on the hosted service.
MIT License
Copyright (c) 2026 Tradi3
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
What your browser loads
Every script, stylesheet and icon this site sends to your browser was written for it. Nothing in the browser is bundled from a third party: no framework, no font files, no icon set and no analytics library. Text is set in the fonts already on your device.
Worker dependencies
The API runs on a Cloudflare Worker. It is built with @simplewebauthn/server and stripe, which bring in 26 packages in all. They run on the server and are not sent to your browser.
MIT22 packages
- @hexagon/base64 1.1.28
- @levischuck/tiny-cbor 0.2.11
- @peculiar/asn1-android 2.10.0
- @peculiar/asn1-asym-key 2.10.0
- @peculiar/asn1-cms 2.10.0
- @peculiar/asn1-csr 2.10.0
- @peculiar/asn1-ecc 2.10.0
- @peculiar/asn1-pfx 2.10.0
- @peculiar/asn1-pkcs8 2.10.0
- @peculiar/asn1-pkcs9 2.10.0
- @peculiar/asn1-rsa 2.10.0
- @peculiar/asn1-schema 2.10.0
- @peculiar/asn1-x509 2.10.0
- @peculiar/asn1-x509-attr 2.10.0
- @peculiar/asn1-x509-post-quantum 2.10.0
- @peculiar/utils 2.0.3
- @peculiar/x509 2.1.0
- @simplewebauthn/server 14.0.3
- pvtsutils 1.3.6
- pvutils 1.2.0
- stripe 23.0.0
- tsyringe 4.10.0
0BSD2 packages
- tslib 1.14.1
- tslib 2.8.1
Apache-2.01 package
- reflect-metadata 0.2.2
BSD-3-Clause1 package
- asn1js 3.0.10
MCP server: no dependencies
The MCP server has no runtime dependencies. The package holds its own code and a copy of the review engine with the three core profiles, all under the MIT licence above. It needs Node 22 or later and installs nothing else.
Data
The acceptance-rate figures in the pattern-stats command and the acceptance rates tool come from a snapshot of public Sherlock contest judging. The snapshot is published under CC0, which asks for no attribution. This is the source file.
Notices
Each package above carries its full licence text and copyright notice in its own distribution, and those texts apply as written. To report a missing or wrong notice, email support@bountyoperator.com.