Privacy Policy

What we collect

Bundle Scan does not require an account and does not store personally identifiable information. When you look up a package, the package name and version you query may be logged transiently for debugging and rate-limiting purposes but is never sold or shared with third parties.

Standard server access logs (IP address, timestamp, HTTP method, path, user-agent) may be retained for up to 30 days to diagnose errors and protect against abuse.

Cookies & analytics

Bundle Scan does not use tracking cookies or third-party analytics scripts. No advertising networks are present on this site.

Third-party data sources

Vulnerability and package data is fetched in real time from the following public services. Your query may be forwarded to these services as part of normal operation:

• OSV.dev — open-source vulnerability database by Google
• GitHub Advisory Database — community-curated security advisories
• NVD (NIST) — National Vulnerability Database
• npm Registry — package metadata and tarball sizes
• PyPI — Python package index metadata
• Maven Central — Java/JVM package metadata

Each of these services has its own privacy policy. We encourage you to review them if you have concerns about how your queries may be processed by those services.

Contact

Questions about this policy? Reach out at thefalcon.dev.