MonitorRisk (the "Software") is proprietary — see LICENSE, Copyright (c) 2026 Krishnendu De, all rights reserved.
That licence covers the Software as authored by the copyright holder. It does not, and cannot, alter the terms of third-party material used by or distributed with it. This file records those components and the notices their licences require.
It is maintained by hand and is part of the release, not documentation trivia: the
Dockerfile produces an image that redistributes some of the code listed below, and
an attribution obligation is not discharged by a comment in a source file nobody
ships.
Components: data/sap_baseline_requirements.json, data/sap_notes_catalogue.json
Upstream: SAP-samples/frun-csa-policies-best-practices
Licence: Apache License, Version 2.0
Copyright: Copyright (c) 2020 SAP SE or an SAP affiliate company
This is the only upstream in this repository authored by a third party. Two files are derived from it, from two different halves of the policy set.
What was taken — the Baseline half (BaselinePolicies/). Requirement
identifiers, titles, priority tiers and configuration store names, parsed from the
published policy XML by server/sapcontent.py and vendored
as JSON so the product works offline.
What was taken — the Notes half (NotesPolicies/). Security-note numbers, CVE
identifiers, SAP application-component keys, CVSS base scores, priority tiers,
patch-day identifiers, note titles, and the configuration stores SAP's own policy
reads to answer each note — parsed by
tools/build_sap_notes_catalogue.py into
data/sap_notes_catalogue.json. 1,732 notes across 154 patch days from 2016-01
onwards. Also taken is SAP's own declaration, in each policy header, of which notes
that policy deliberately does not check.
And the affected-version facts. SAP's <compliant> and <noncompliant> clauses
encode which component release at which support-package level carries each fix —
that note 3772411 is fixed in SAP_BASIS 750 at SP 0037. Those facts are extracted
(6,637 component/release/SP triples across 837 notes); the SQL expressing them is
not executed, not reproduced, and no Focused Run parity is claimed. The
comparison against the customer's own component export is this project's own code.
between-range predicates are deliberately left uninterpreted and counted in the
file's metadata rather than guessed at.
The two generators are separate because their consumers are: the Baseline catalogue
feeds the server's coverage page, and the notes catalogue feeds
modules/sap_hotnews.py, which is part of the offline
scanner and may not import from server/. Both are re-derived by the same
sap-content CI job, so neither can drift from upstream unnoticed.
What was NOT taken, and this matters. SAP's prose is not reproduced, and SAP's SQL
predicates are neither copied nor executed — they run against SAP Focused Run's CCDB,
which this product does not have. Claiming to run SAP's policies would be false, and
server/sapcontent.py says so at length.
Statement of modification (Apache-2.0 §4(b)). The vendored file is a derived
works, not copies: the upstream XML is parsed, filtered to the fields listed
above, restructured into single JSON documents and annotated with counts and this
project's own mappings — for the notes catalogue, a mapping from SAP's configuration
store names to the exports this product reads, which is this project's work and not
SAP's. They are regenerated by python -m server.cli rebuild-sap-catalogue and
python -m tools.build_sap_notes_catalogue --source <checkout>, and the
sap-content CI job re-derives both from upstream and fails on drift.
Attribution retained (§4(c)). Each derived file carries the upstream source,
licence and copyright in its own _meta block, so the notice travels with the data
rather than only with this document.
Licence text (§4(a)). The Apache License 2.0 is reproduced in
licenses/Apache-2.0.txt.
Trademarks. SAP, SAP S/4HANA, SAP Focused Run and related marks are trademarks of SAP SE. Their use here is nominative — to identify the systems this tool assesses — and implies no affiliation with or endorsement by SAP SE. Apache-2.0 grants no trademark rights (§6) and none is claimed.
Installed by pip into the runtime image and redistributed with it. Pinned in
requirements.txt; each is used under its own licence.
Licences below are read from each distribution's own License-Expression metadata,
not from memory:
| Package | Licence |
|---|---|
fastapi |
MIT |
uvicorn[standard] |
BSD-3-Clause |
psycopg, psycopg-binary, psycopg-pool |
LGPL-3.0-only |
python-multipart |
Apache-2.0 |
psycopg is LGPL-3.0-only — the one entry here with an ongoing condition. It is
used as an unmodified library, imported at runtime and installed as a separate
wheel: not statically combined, not vendored, not patched. That is the arrangement
LGPL permits for a work that merely uses the library, and the recipient's ability to
substitute a modified psycopg is preserved by it being an ordinary site-packages
install that can be replaced in place.
Do not vendor, fork or patch psycopg into this repository. Any of those would make this project a derivative of an LGPL work and pull copyleft terms onto code that LICENSE licenses proprietarily. If psycopg ever needs a change, the change belongs upstream or in a separately distributed fork, never inlined here.
psycopg[binary] additionally bundles a prebuilt libpq (PostgreSQL License, a
permissive BSD-style licence, Copyright (c) 1996-2024 The PostgreSQL Global Development
Group) together with its own TLS dependencies, all redistributed inside the wheel by
its publisher under their respective terms.
Build-time only, never in the runtime image and not redistributed: pytest, httpx,
Pillow (used by tools/build_brand_assets.py; deliberately absent from
requirements.txt).
Compiled by Vite into server/spa/ at image build time, so their code is
redistributed inside the compiled bundle. Declared in
frontend/package.json and pinned with full licence metadata
in frontend/package-lock.json, which is the authoritative list including transitive
packages.
| Package | Licence |
|---|---|
react, react-dom |
MIT |
react-router |
MIT |
lucide-react |
ISC |
tailwindcss, @tailwindcss/vite |
MIT |
vite, @vitejs/plugin-react |
MIT |
typescript |
Apache-2.0 |
To regenerate the authoritative list of everything actually bundled:
cd frontend && npx license-checker --production --summaryAt the time of writing that reports MIT ×6, ISC ×1 across the production tree,
plus one UNLICENSED entry which is monitorrisk-console@0.1.0 — this project's own
frontend package. It is marked "private": true with no license field, which is the
correct declaration for a proprietary package and stops npm publish from ever
working by accident. Do not "fix" it by adding a licence identifier.
modules/abap_sast_rules.py is assembled by tools/build_abap_rules.py from
SAP-Code-Vulnerability-Analyzer, whose LICENSE reads "MIT, Copyright (c) 2026
KRISH". That reads like a third-party MIT dependency and was briefly recorded as one.
It is not. Both repositories are under the same GitHub organisation
(Krishcalin) and share the same two commit identities —
KRISH <krishnendu.de@hotmail.com> and Krishnendu De <krishcalin@gmail.com>. It is
the same author, so no third-party obligation arises: a copyright holder cannot
infringe their own copyright, and may license the same work under different terms in
different places.
Two consequences worth stating, because neither is obvious:
- Publishing that code under MIT elsewhere does not retroactively license this repository. Anyone who obtained it from the MIT repository holds an MIT licence to that copy; this copy is governed by LICENSE.
- Equally, relicensing here does not revoke the MIT grant already made upstream. MIT is irrevocable for copies already distributed under it. If that is not the intent, the upstream repository's own licence is the thing to change — not this one.
Errors or omissions in these notices: krishnendu.de@hotmail.com