# SecureVector Contributor Agreement

**Project:** SecureVector AI Threat Monitor  
**Repository:** https://github.com/secure-vector/ai-threat-monitor  
**Effective Date:** January 1, 2025

---

## 📋 Table of Contents

1. [Overview](#overview)
2. [Contributor License Agreement (CLA)](#contributor-license-agreement-cla)
3. [Contributing Guidelines](#contributing-guidelines)
4. [Commercial Development Intent](#commercial-development-intent)
5. [Legal Terms & Protections](#legal-terms--protections)

---

## 🔓 Overview

**Welcome to SecureVector!** This document combines our Contributor License Agreement (CLA) and contribution guidelines into one comprehensive agreement. 

### Important Notice for Contributors

This project is currently **100% open source** under Apache 2.0 license. However, SecureVector may develop enhanced monitoring, professional, and enterprise versions in the future that could include:

- Additional monitoring features and capabilities
- Enhanced performance optimizations  
- Professional monitoring support and services
- Enterprise integrations and compliance monitoring features

**By contributing to this project, you acknowledge and agree to ALL terms in this document.**

---

## 📜 Contributor License Agreement (CLA)

### Purpose

This Contributor License Agreement ("CLA") clarifies the intellectual property license granted with contributions to SecureVector AI Threat Monitor. This agreement protects both contributors and SecureVector, ensuring the project can be used commercially while maintaining open source availability.

### 1. Definitions

- **"Contribution"** means any work of authorship, including code, documentation, or other creative works, submitted by you to the project
- **"You"** means the individual or legal entity making a contribution
- **"SecureVector"** means SecureVector and its affiliates
- **"Project"** means SecureVector AI Threat Monitor

### 2. Copyright License Grant

You grant to SecureVector a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to:

- ✅ Use, reproduce, and modify your contributions
- ✅ Publicly display and distribute your contributions  
- ✅ Prepare derivative works based on your contributions
- ✅ Sublicense the above rights to third parties
- ✅ Include your contributions in commercial products
- ✅ **Relicense your contributions under any license** including copyleft, permissive, commercial, or proprietary licenses
- ✅ **Change the project license** using your contributions without additional consent

### 3. Patent License Grant

You grant to SecureVector a perpetual, worldwide, non-exclusive, royalty-free, irrevocable patent license to:

- ✅ Make, use, sell, and distribute your contributions
- ✅ License these rights to third parties
- ✅ Use patent claims you own or control that are infringed by your contributions

**Patent Litigation Termination:** This patent license terminates automatically if you initiate patent litigation against SecureVector or any licensee regarding the Work or contributions incorporated within the Work.

### 4. Your Rights and Representations

You represent that:

- ✅ **You own the copyright** to your contributions OR have authorization to submit them
- ✅ **Your employer (if any)** does not restrict your ability to contribute
- ✅ **Your contributions are original** or you have rights to submit derivative works
- ✅ **You have legal authority** to enter into this agreement
- ✅ **Your contributions do not violate** any third-party intellectual property rights
- ✅ **You will notify SecureVector** if you become aware of any facts that make these representations inaccurate

**Third-Party Materials:** If your contribution includes third-party materials, you must identify them and provide details about their licensing terms.

### 5. Employment and Corporate Considerations

**Individual Contributors:**
- 💼 **Employer approval may be required** - check your employment agreement
- 💼 **Work-for-hire contributions** require employer consent or assignment
- 💼 **You represent** that your employer does not claim ownership of contributions

**Corporate Assignment:** If contributions are made in connection with your employment or contain employer intellectual property, you must have your employer sign a Corporate CLA.

### 6. Attribution and Recognition

SecureVector agrees to:

- ✅ **Maintain attribution** of your contributions in the open source version
- ✅ **Include your name** in contributor lists and acknowledgments
- ✅ **Provide attribution** in commercial versions where technically feasible
- ✅ **Not use your name** for endorsement without permission

### 7. License Change Rights and Limitations

**SecureVector Rights:**
- 🔄 **License changes permitted** for future versions using any license model
- 🔄 **Dual licensing allowed** for commercial and open source versions
- 🔄 **No contributor consent required** for license changes to new versions

**Open Source Commitment:**
- ✅ **Current Apache 2.0 version** will remain available under Apache 2.0
- ✅ **You can continue using** existing open source versions under Apache 2.0
- ✅ **Historical versions** maintain their original licenses

### 8. Commercial Development Rights

You acknowledge and agree that:

- 🏢 **SecureVector may develop commercial versions** using your contributions
- 🏢 **Commercial versions may include** proprietary enhancements beyond your contributions  
- 🏢 **You will NOT receive royalties** from commercial versions
- 🏢 **You cannot revoke these rights** once granted

### 9. No Monetary Compensation

You explicitly acknowledge and agree that:

- 💰 **SecureVector is NOT responsible** for any monetary compensation for your contributions
- 💰 **No entitlement to revenue sharing** exists if SecureVector monetizes the project
- 💰 **No future claims** for compensation can be made based on commercial success
- 💰 **Contributions are voluntary** with no expectation of financial return
- 💰 **This waiver is permanent** and cannot be revoked or modified

### 10. No Obligation to Use

SecureVector has no obligation to:
- Use or include your contributions
- Maintain or support your contributions
- Provide attribution beyond what's stated above

### 11. Disclaimer and Limitation of Liability

**Warranty Disclaimer:**
- ⚠️ **Contributions are provided "AS IS"** without warranties of any kind
- ⚠️ **No warranties** of merchantability, fitness for purpose, or non-infringement
- ⚠️ **No guarantee** of contribution acceptance or inclusion

**Liability Limitation:**
- 🚫 **No liability** for any damages arising from contributions or their use
- 🚫 **Maximum liability limited** to $100 USD in aggregate
- 🚫 **No liability** for indirect, consequential, or punitive damages
- ⚠️ **Standard Apache 2.0 limitations** apply where applicable

### 12. Governing Law and Dispute Resolution

**Governing Law:** This agreement is governed by Delaware law, USA, without regard to conflict of law principles.

**Dispute Resolution:**
- ⚖️ **Binding arbitration** required for disputes over $10,000
- ⚖️ **Delaware courts** have exclusive jurisdiction for smaller disputes  
- ⚖️ **No class actions** - all disputes must be individual
- ⚖️ **Fee shifting** - prevailing party recovers attorney fees for frivolous claims

---

## 🤝 Contributing Guidelines

### How to Agree to This CLA

**For Individual Contributors:**
By submitting a pull request, you indicate agreement with these terms.

**For Corporate Contributors:**  
Please create a GitHub issue with the label "corporate-cla" for corporate CLA requests.

### Getting Started

1. **Fork the repository**
2. **Create a feature branch**: `git checkout -b feature/your-feature`
3. **Make your changes**
4. **Add tests** for your changes
5. **Run the test suite**: `pytest`
6. **Submit a pull request**

### What We Welcome

- 🐛 **Bug fixes** in the core security engine
- ⚡ **Performance improvements** to local analysis
- 🔍 **New threat detection patterns** for the community
- 📚 **Documentation improvements**
- 🧪 **Test coverage improvements**
- 🔒 **Security vulnerability fixes**
- 🔧 **Framework integrations** (Django, FastAPI, etc.)

### Threat Pattern Contributions

We especially welcome new threat detection patterns! Submit them to the `rules/` directory:

```yaml
name: "Your Pattern Name"
description: "What this detects"
version: "1.0"

patterns:
  - pattern: "your\\s+regex\\s+pattern"
    risk_score: 75  # 1-100 scale
    description: "What this specific pattern catches"
```

#### Pattern Guidelines
- Risk scores 70+ trigger threat detection
- Use descriptive names and descriptions
- Test against false positives
- Include examples in your PR description

### Code Style

- **Python**: Follow PEP 8, use Black formatter
- **Type hints**: Required for all new functions
- **Docstrings**: Use Google-style docstrings
- **Comments**: Explain complex logic, not obvious code

### Testing

All contributions must include tests:

```python
def test_your_feature():
    # Test the functionality
    assert feature_works_correctly()
    
def test_threat_pattern():
    # Test threat detection patterns
    engine = SecurityEngine()
    result = engine.analyze_prompt("malicious prompt")
    assert result.is_threat == True
```

### What We Don't Accept

- Code that disables or bypasses security features
- Malicious patterns designed to create false positives
- Copyright violations or plagiarized code
- Spam or low-quality submissions

---

## 🏢 Commercial Development Intent

### Future Commercial Development

While not yet implemented, future commercial versions might include:
- Enhanced performance optimizations
- Advanced threat intelligence feeds
- Team collaboration dashboards
- Compliance reporting tools
- Professional support services

**These are not currently available and may or may not be developed.**

### What This Means for Contributors

- ✅ **All current code remains open source** under Apache 2.0
- ✅ **Contributors will be credited** in all versions
- ✅ **Community benefits** from any improvements made
- ✅ **Commercial development** helps fund continued open source development

---

## ⚖️ Legal Terms & Protections

### Your Rights
1. ✅ **You retain copyright** ownership of your contributions
2. ✅ **You grant SecureVector** a perpetual, worldwide, royalty-free license to use your contributions
3. ✅ **You have the legal right** to make the contribution (no employer restrictions, etc.)
4. ✅ **Your contributions are original** or you have rights to submit them

### Commercial Usage Rights  
1. 🏢 **SecureVector may use** your contributions in future commercial products
2. 🏢 **SecureVector may modify** your contributions for commercial versions
3. 🏢 **You will receive attribution** in both open source and commercial versions
4. 🏢 **You will NOT receive royalties** from commercial products using your contributions

### No Monetary Compensation
1. 💰 **SecureVector is NOT responsible** for any monetary compensation for your contributions
2. 💰 **No entitlement to revenue sharing** exists if SecureVector monetizes the project  
3. 💰 **Contributions are voluntary** with no expectation of financial return
4. 💰 **This waiver is permanent** and cannot be revoked

### Legal Protections
- 🔒 **Apache 2.0 patent protection** applies to your contributions
- 🔒 **Standard limitation of liability** protections
- 🔒 **No warranty requirements** on your contributions

---

## 💬 Communication & Support

- **GitHub Issues**: For bug reports and feature requests
- **GitHub Discussions**: For questions and ideas
- **Legal Questions**: Create GitHub issue with "legal" label
- **Technical Questions**: Create GitHub issue with "question" label  
- **Commercial Questions**: Create GitHub issue with "commercial" label
- **Security Issues**: Create GitHub issue with "security" label

---

## 🔒 Security Issues

For security vulnerabilities:
- **Create GitHub issue** with "security" label (mark as private if your repository supports private issues)
- **For critical vulnerabilities** contact through GitHub's private vulnerability reporting if available
- **Response time**: 24 hours for acknowledgment

---

## 📄 License Headers

All new files should include:

```python
"""
Description of the file.

Copyright (c) 2025 SecureVector
Licensed under the Apache License, Version 2.0
"""
```

---

## 🙏 Recognition

Contributors are recognized through:
- **CONTRIBUTORS.md** file listing
- **Git commit history** preservation
- **Release notes** mentions for significant contributions
- **GitHub profile** contribution graphs

---

## 🎯 Roadmap Priorities

Current open source development priorities:

1. **Expand threat pattern library** - More community detection rules
2. **Performance optimization** - Faster local analysis
3. **Framework integrations** - Django, FastAPI, Flask plugins
4. **Testing infrastructure** - Better CI/CD and test coverage
5. **Documentation** - Tutorials and integration guides

---

**By submitting a pull request, you acknowledge you have read and agree to these terms.**

---

**SecureVector Team**  
Date: January 1, 2025

---

## Summary for Contributors

**✅ What you get:**
- Credit and attribution for your work
- Your code remains open source forever
- Legal protection under Apache 2.0
- Community benefit from your contributions

**🏢 What SecureVector gets:**
- Rights to use contributions in commercial products
- Ability to build sustainable business around the project
- Clear legal framework for development

**🤝 Win-Win:**
- Project remains open source
- Commercial development funds continued open source development
- Contributors get recognition and community impact
- Users benefit from both free and commercial versions

This CLA is based on industry-standard agreements used by major open source projects.

---

<div align="center">
  <strong>Thank you for helping make AI applications more secure!</strong> 🛡️
  <br><br>
  <em>By contributing, you're helping build better security tools for the entire AI development community.</em>
</div>