Version outcomes-2026-11

NOX Intelligence outcome terms, version outcomes-2026-11

Outcome reports are optional and off by default. They need contribution on
(scan.intelligence.contribute: true, with the contribution terms accepted),
scan.intelligence.outcomes: true, AND these terms accepted on this machine.

Why
  A vulnerability nox could not decide is ordered by what is known about the
  advisory, never about your application. Learning which ones matter needs to
  see what happened next: a finding that went away after an upgrade, across
  many projects. One report per scan makes that possible.

What is sent, per scan
  Only the fields printed by "nox intel allowlist --outcomes": a pseudonym for
  this project, and for each vulnerable dependency its ecosystem, name, exact
  version and advisory id, and what nox decided about it (impacting, not
  impacting or undetermined, the step it reached and why it stopped, and
  whether your own source imports the package). Plus your reporter id, a
  timestamp, the nox version and the terms you accepted.

The project pseudonym
  An HMAC of the repository's first commit, keyed by a secret that stays on
  this machine. The same repository scanned here always gives the same
  pseudonym; anyone else scanning it gets a different one; nobody can turn it
  back into a repository. No pseudonym, no report: a shallow clone or a
  directory outside git sends nothing.

What is never sent
  Source code, file names or paths, the repository's name or URL, commit
  hashes, branch names, route paths, symbol names, secrets or prompts.

The honest limit
  A pseudonym together with packages and versions over time describes a
  technology stack. That is why this is a separate opt-in, why the service
  publishes only models and aggregates over many projects and never anything
  per project, and why you can delete it.

What the service does with it
  Keeps one report per project and day, deletes it after the retention window
  (90 days by default), and uses the reports to train and measure models that
  order undecided findings. Nothing per project is published.

How to erase and withdraw
  "nox intel forget" deletes your outcome reports along with your other
  contributions and turns both off on this machine. Withdraw here, without
  contacting the service, with "nox intel consent outcomes withdraw".

Who is responsible
  NOX Intelligence at intel.klarlabs.de is run by Felix Geelhaar
  (klarlabs-studio), who is the controller of what it receives. Write to
  nox@felixgeelhaar.de with questions, or to see what the service holds about
  you ("nox intel preview --outcomes" prints your reporter id and project
  pseudonym). The service and its backups run on Hetzner servers in Germany
  and Finland (Helsinki), inside the EU. A self-hosted service
  (scan.intelligence.endpoint) is the responsibility of whoever runs it.

Legal basis and your rights
  Your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time; that does
  not make what was sent before unlawful. You may ask for access to, correction
  of or erasure of your data, and complain to a data protection supervisory
  authority.

These terms are published, unchanged, at https://nox-hq.dev/terms/outcomes-2026-11

If these terms change, outcome reports pause until you accept the new version.