TERMS OF SERVICE
The agreement, in plain terms
These terms apply when you create an account, hold an API key, or call the Cohen API. If you are agreeing on behalf of a company, you are confirming you have the authority to bind it. If you do not accept these terms, do not use the service.
Last updated 4 September 2026. Provided by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], India.
THE MOST IMPORTANT CLAUSE
A verdict is evidence, not a judgement
Cohen reports what a package did when it ran in a sandbox. That is all it
reports. A review verdict means the sandbox observed behaviour a
person should look at, and it is never an assertion that a package or its
author is malicious. A clean verdict means nothing correlated on
the run we did, at the time we did it, and is not a guarantee that a package
is safe.
You are responsible for what you do with a verdict. Do not treat Cohen as the sole basis for blocking a deployment, removing a package, or making any accusation about a person or organisation. Fred Cohen proved in 1984 that the general problem is undecidable; we do not claim to have solved it.
ACCOUNTS AND KEYS
Your key is your responsibility
One account per person
Do not create multiple accounts to obtain additional free allowance. We may suspend accounts that do.
Keys are secrets
Keep them out of public repositories, client-side code and shared logs. Requests made with your key are treated as made by you. Revoke a key from your dashboard the moment you suspect it has leaked.
Keys expire
Free keys are valid for seven days and can be extended from the dashboard at any time. Paid keys run for ninety days. After expiry a key keeps reading verdicts for a short grace period and then stops entirely.
Accuracy
Keep the email address on your account current. It is how we warn you before a key expires.
ACCEPTABLE USE
What you must not do
- Attempt to escape, subvert or attack the analysis sandbox, or use it to execute code for any purpose other than analysing a published package.
- Submit packages you have created for the purpose of testing our detection, without telling us first. Security research is welcome; coordinate with us.
- Resell, redistribute or expose the API as a competing service, or scrape the verdict database in bulk outside the Observatory feed.
- Circumvent rate limits or allowances, including by rotating accounts.
- Use the service to harass, defame or make unfounded public accusations against a package author.
- Use the service in breach of any law that applies to you, including export controls and sanctions.
We may suspend an account that breaches these terms. Where it is reasonable to do so we will tell you first and give you a chance to put it right.
PLANS AND BILLING
One meter, no surprises
What is metered
Only a deep analysis: one package version, run once. Verdict lookups and Mantis are never metered on a paid plan, and are capped at 100 a day on Free.
Going over
Individual stops at its limit rather than billing you for going over. Team continues at the published overage rate and warns you first. Nothing upgrades without being asked.
Changes in price
We will give at least 30 days' notice by email before a price change affects you, and you may cancel before it takes effect.
Cancellation
Cancel at any time. Access continues to the end of the paid period. Unused allowance does not carry over and is not refunded.
AVAILABILITY
No uptime promise on the free plan
The service is provided as it is. We do not commit to an availability target except where a separate written agreement says otherwise. We may change, suspend or discontinue any part of the service, and we will give reasonable notice before removing something you depend on.
When the sandbox is saturated, reads keep working and queueing does not, and nothing is charged for a request we could not accept.
OWNERSHIP
Who owns what
We own the service, the analysis engine and the verdict database. You are granted a non-exclusive, revocable right to use the API and its output inside your own organisation and products for the term of your plan.
Mantis is separately licensed under the MIT licence, and nothing here limits the rights that licence gives you.
You keep everything you send us. You grant us only the licence needed to run the service: to process the package names and versions you submit, and to store the resulting analysis. Because results are cached across all customers, an analysis you trigger for a public package becomes part of the shared verdict database.
WARRANTIES AND LIABILITY
The limits
To the fullest extent the law allows, the service is provided without warranties of any kind, express or implied, including fitness for a particular purpose and non-infringement. We do not warrant that verdicts are complete or accurate, or that the service will be uninterrupted or error free.
To the fullest extent the law allows, we are not liable for indirect or consequential loss, lost profits, lost data, or loss arising from a security incident in a package we did not flag. Our total liability for any claim relating to the service is limited to the greater of the fees you paid us in the twelve months before the claim, or ten thousand rupees.
Nothing here excludes liability that cannot lawfully be excluded, including for fraud or for death or personal injury caused by negligence. Some jurisdictions do not allow certain exclusions, in which case they apply to you only to the extent permitted.
GENERAL
The rest
Governing law
These terms are governed by the laws of India, and the courts of [CITY] have exclusive jurisdiction.
Changes
We may update these terms. For material changes we will email the address on your account at least 30 days before they take effect. Continuing to use the service after that means you accept them.
Severability
If any clause is found unenforceable, the rest continues to apply.
Privacy
Our handling of personal data is described in the privacy policy, which forms part of these terms.