Our policy
CipherForces tools run inside your browser using JavaScript and WebAssembly libraries published under open-source licenses (MIT, Apache 2.0, BSD, ISC, and LGPL). We follow every project’s license terms and preserve the required notices.
Rather than maintain a hand-edited HTML table that drifts out of date every time we add or remove a dependency, we take a simpler approach: the full license text for every library bundled into our production JavaScript is preserved inside the deployed bundle itself. If you inspect the source of any tool page in DevTools, you’ll see the license headers of every library that runs on your device.
How to verify
- Open any CipherForces tool page
- Open DevTools → Sources → look under
_next/static/chunks/ - License headers are preserved at the top of each minified chunk — every project we depend on appears there with its MIT / Apache 2.0 / BSD / ISC / LGPL notice
This satisfies the attribution obligation for substantial portions distributed to end users under common permissive licenses, and is the standard practice for modern SaaS products built on Next.js / webpack.
Copyleft (LGPL) libraries
We use one LGPL-licensed library: FFmpeg.wasm. Corresponding source is available at github.com/ffmpegwasm/ffmpeg.wasm. We link to the library as a separate WebAssembly module, and users can obtain or replace it per the LGPL.
Ask for the list
Need the current dependency list for legal or compliance purposes? Email legal@cipherforces.comand we’ll send you our complete package.jsondependency list with each project’s license identifier, within two business days.
If you believe a library we ship is missing a notice that the license requires, please email the same address and we’ll correct it promptly.
Server-side dependencies
Libraries used only on our server infrastructure (API routes, build tooling, deployment) are not listed here because they are not distributed to users. Common-license notice obligations generally apply to “substantial portions” of software that is distributed — for a SaaS web app, that means the client-bundled JavaScript, not private server code.