From aa8d139b80693c6ac1646b7c0acdd3f44afa0115 Mon Sep 17 00:00:00 2001 From: Greg Anderson Date: Thu, 22 Oct 2026 11:56:43 -0600 Subject: [PATCH] Rename the action for the Marketplace and add a privacy section The Marketplace requires a unique action name and "Early Light" is taken, so the action is now "Early Light by DefectDojo". The README now says what the engine connects to, that it has no telemetry, and links the privacy policy. Co-Authored-By: Claude Opus 5.5 --- README.md | 18 ++++++++++++++++++ action.yml | 2 +- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index c377d97..0b5af70 100644 --- a/README.md +++ b/README.md @@ -130,6 +130,24 @@ python3 parity/parity.py path/to/emudhra-scan path/to/earlylight python3 parity/php.py path/to/php2shell-scan ./php2shell-scan ./earlylight path/to/emudhra-scan cases.json ``` +## Privacy + +Early Light runs entirely on your machine or CI runner. It has no telemetry, no analytics and no account, and it sends nothing to DefectDojo. + +It only makes network connections when a scan needs them: + +| What | Connects to | +| --- | --- | +| Installing (`install.sh` and the GitHub Action) | GitHub, to download the release and its `checksums.txt`. When `cosign` is installed, it also fetches Sigstore's public trust root to check the signature | +| `scan image` | The registry that hosts the image you name | +| `scan repo` and `fix` | The registries that host the images your source tree references. `--offline` turns this off, and `--public-registries-only` refuses private and internal addresses | +| `scan host` | The hosts you name, for a TLS handshake | +| `scan fs` | Nothing | + +Results stay where you put them: the SARIF file, the job summary and, when you set `upload-sarif: true`, GitHub code scanning in your own repository. + +DefectDojo's privacy policy is at [defectdojo.com/privacy-policy](https://defectdojo.com/privacy-policy). + ## License BSD 3-Clause. The licenses of the Go standard library and the modules compiled into the binaries are in [THIRD_PARTY_NOTICES.txt](THIRD_PARTY_NOTICES.txt), which ships with every release and in the container image at `/licenses/`. After changing `go.mod`, run `scripts/third-party-notices.sh` and commit the result. CI fails when it is out of date. diff --git a/action.yml b/action.yml index 8240bca..03d6515 100644 --- a/action.yml +++ b/action.yml @@ -1,4 +1,4 @@ -name: Early Light +name: Early Light by DefectDojo description: Scan for emerging vulnerabilities with DefectDojo's Early Light engine and report SARIF. author: DefectDojo branding: