Security
Third-party licences
DFIRe is built using open source software. This page lists the third-party libraries and their licenses.
License Summary
DFIRe uses only open source libraries with licenses that permit commercial use. The following license types are used by our dependencies:
| License |
Type |
Commercial Use |
| MIT |
Permissive |
Allowed |
| BSD (2-Clause, 3-Clause) |
Permissive |
Allowed |
| Apache 2.0 |
Permissive |
Allowed |
| ISC |
Permissive |
Allowed |
| MIT-CMU |
Permissive |
Allowed |
| BlueOak-1.0.0 |
Permissive |
Allowed |
| Unlicense |
Public domain |
Allowed |
| MPL 2.0 |
Weak Copyleft |
Allowed (see note below) |
| LGPL (2.1 / 3.0) |
Weak Copyleft |
Allowed (see note below) |
| RSALv2 / SSPLv1 |
Source Available |
Allowed (see note below) |
| PSF (Python) |
Permissive |
Allowed |
| PostgreSQL License |
Permissive |
Allowed |
| ZPL 2.1 |
Permissive |
Allowed |
LGPL Note: The psycopg2 PostgreSQL driver is licensed under LGPL 3.0 and the paramiko SSH/SFTP library under LGPL 2.1. Under LGPL terms, you may use these libraries in commercial applications without releasing your own source code, provided you do not modify the libraries themselves. DFIRe uses both as unmodified dependencies.
MPL 2.0 Note: mozilla-django-oidc and DOMPurify are licensed under MPL 2.0 (DOMPurify is dual-licensed Apache-2.0/MPL-2.0), as are the transitive dependencies certifi and tqdm. MPL 2.0 is a file-level copyleft license: modifications to MPL-licensed source files must be made available, but it does not require disclosure of surrounding proprietary code. DFIRe uses these libraries as unmodified dependencies.
Redis Note: DFIRe ships Redis 8, which the Redis project offers under your choice of RSALv2, SSPLv1 or AGPLv3. RSALv2 permits using Redis as a component in commercial software. It only restricts offering Redis itself as a competing managed database service. DFIRe uses Redis as an internal caching and message broker component, which is fully permitted under these terms.
Backend Dependencies (Python)
The DFIRe backend is built with Python and uses the following key libraries:
Web Framework
Database & Caching
Security & Authentication
| Package |
License |
Purpose |
| cryptography |
Apache-2.0 / BSD |
Encryption primitives |
| mozilla-django-oidc |
MPL-2.0 |
OpenID Connect authentication |
| PyJWT |
MIT |
JSON Web Token handling |
| pyOpenSSL |
Apache-2.0 |
TLS/SSL support |
| Bleach |
Apache-2.0 |
HTML sanitization |
| django-otp |
Unlicense |
Multi-factor authentication devices |
| Segno |
BSD-3-Clause |
QR codes for authenticator enrolment |
Storage & Cloud
| Package |
License |
Purpose |
| boto3 |
Apache-2.0 |
AWS/S3-compatible storage |
| django-storages |
BSD-3-Clause |
Storage backend abstraction |
| smbprotocol |
MIT |
SMB/CIFS file sharing |
| paramiko |
LGPL-2.1 |
SSH/SFTP file transfer |
Data Processing
Integrations
| Package |
License |
Purpose |
| jira |
BSD-3-Clause |
Jira integration |
| Slack Bolt |
MIT |
Slack integration |
| LiteLLM |
MIT |
LLM API abstraction |
| google-auth |
Apache-2.0 |
Google Vertex AI service-account authentication |
Transitive Dependencies
The following notable libraries are included as transitive dependencies (pulled in by the packages above):
| Package |
License |
Purpose |
| Twisted |
MIT |
Async networking (via Daphne) |
| Autobahn |
MIT |
WebSocket implementation (via Daphne) |
| zope.interface |
ZPL-2.1 |
Interface definitions (via Twisted) |
| Pydantic |
MIT |
Data validation (via LiteLLM) |
| HTTPX |
BSD-3-Clause |
Async HTTP client (via LiteLLM) |
| openai |
Apache-2.0 |
OpenAI API client (via LiteLLM) |
| tiktoken |
MIT |
LLM token counting (via LiteLLM) |
| huggingface_hub, tokenizers |
Apache-2.0 |
Tokenizer support (via LiteLLM) |
Frontend Dependencies (JavaScript)
The DFIRe frontend is a React single-page application using the following libraries:
Core Framework
Styling & UI
Data & HTTP
| Package |
License |
Purpose |
| Axios |
MIT |
HTTP client |
| date-fns |
MIT |
Date manipulation |
Content & Security
Build Tools
| Package |
License |
Purpose |
| Vite |
MIT |
Build tool & dev server |
| TypeScript |
Apache-2.0 |
Type checking |
| ESLint |
MIT |
Code linting |
| Vitest |
MIT |
Testing framework |
Runtime Dependencies
DFIRe runs on the following open source infrastructure components:
| Component |
License |
Purpose |
| Python |
PSF License |
Backend runtime |
| Node.js |
MIT |
Frontend build |
| PostgreSQL |
PostgreSQL License |
Database |
| Redis |
RSALv2 / SSPLv1 / AGPLv3 |
Caching & message broker |
| Nginx |
BSD-2-Clause |
Web server (production) |
License Compliance
DFIRe complies with all license requirements of its dependencies:
- Attribution: This page provides attribution as required by BSD, MIT, and Apache licenses.
- Source availability: All dependencies are available from their respective package registries (PyPI, npm) or source repositories.
- No modification: DFIRe uses all dependencies as unmodified libraries, satisfying LGPL and MPL requirements without source disclosure obligations.
- Redis usage: DFIRe uses Redis as an internal infrastructure component (caching and message broker), which is permitted under the RSALv2 license terms.
- License texts: Full license texts are included in the respective packages and available from the links above.
Questions? If you have questions about licensing or need additional compliance documentation, please contact us at [email protected].