shkSecurity Harness Kit

Terms of Service

These Terms of Service (the "Terms") govern the use of the following, provided by the developer and maintainer of shk (Security Harness Kit), GitHub account Kazuki-tam (the "Operator"), collectively the "Service":

  • the shk CLI and shk Desktop (together, the "Software")
  • the documentation site for the Software (the "Site")

By using the Service you agree to these Terms. If you do not agree, do not use the Service.

1. Relationship to the MIT License

  1. The Software is open source. Its source code and binaries are provided under the MIT License.
  2. These Terms do not limit the rights the MIT License grants you (to copy, modify, redistribute, and so on). If these Terms and the MIT License conflict regarding the copyright treatment of the Software, the MIT License prevails.
  3. These Terms cover what the MIT License does not: how the Service is used, use of the Site, prohibited conduct, and the allocation of responsibility between the Operator and you.

2. Nature of the Service

  1. The Software is a supplementary tool that detects secrets and personal data in code, prompts, and documents using patterns, masks them, and stops risky actions through hooks for AI coding tools.
  2. Detection is pattern-based and is not guaranteed to find every secret, every piece of personal data, or every risky action. False positives (flagging harmless content) and false negatives (missing harmful content) can occur.
  3. The Software is not a substitute for professional security review, a dedicated secret-scanning platform, or an organization's own information-security program. Use it as an additional check at the boundary with AI tools.
  4. The Software is provided free of charge. The Operator makes no commitment regarding availability, continuity, or fitness for any particular purpose.

3. Eligibility and Conditions of Use

  1. You must comply with applicable law and these Terms when using the Service.
  2. You may use the Software only on projects, files, repositories, and data you are authorized to use. If you process third-party data, you are responsible for obtaining the necessary permissions or consent.
  3. If you use the Software as a member of an organization, you are responsible for following that organization's policies.

4. Your Responsibilities

  1. Reviewing results. Findings, masked output, and audit logs are informational. You are responsible for the final review of anything you share with AI tools or third parties.
  2. File modifications. Features such as shk mask --output, shk doctor --fix, shk hooks install, and shk ci init create or modify files. Understand what they do before running them, and use version control or backups where appropriate.
  3. Limits of hooks. Hooks for AI coding tools are a supplementary safeguard that depends on each tool invoking its hook mechanism correctly. They do not control or guarantee every behaviour of an AI agent.
  4. Secret management. You are responsible for the private keys handled by shk env and for any external secret store you configure, such as the OS keyring or 1Password.
  5. CI usage. You are responsible for reviewing and operating the workflows generated by shk ci, including their runtime environment and permissions.

5. Third-Party Services

  1. Depending on your actions, the Software may communicate or integrate with external services, including:
    • GitHub (downloading releases, update checks by shk status and shk doctor version, desktop app update checks, GitHub Actions)
    • the npm registry (installation through npm or bun)
    • the OS keyring, 1Password, AWS Secrets Manager, and Google Cloud Secret Manager (when configured as the shk env secret store)
    • AI coding tools such as Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, and Windsurf (as targets for hooks and skills)
  2. Use of those services is subject to their providers' terms and privacy policies. The Operator is not responsible for their availability, changes, costs, or any damage arising from them.
  3. Links from the Site to external sites are provided for information only; the Operator does not endorse or guarantee their content.

6. Prohibited Uses

You must not:

  1. use the Service in violation of law or public order, or in connection with criminal activity;
  2. use the Software against systems, repositories, or data you are not authorized to access;
  3. publish or share findings or audit logs out of context in a way that implies wrongdoing or negligence by a specific person or organization;
  4. place excessive load on the Site or access it in bulk through automated means;
  5. use the "shk" or "Security Harness Kit" names or logos in a way that suggests the Operator provides or endorses something it does not; or
  6. engage in any other conduct the Operator reasonably considers inappropriate.

7. Intellectual Property

  1. Rights in the Software's source code and binaries are governed by the MIT License.
  2. Unless stated otherwise, documentation on the Site is licensed under the same license as the Software's repository.
  3. The "shk" and "Security Harness Kit" names, logos, and designs belong to the Operator. The MIT License does not grant permission to use them. If you distribute a modified version, use a name that cannot be confused with the Operator's official releases.

8. Disclaimer of Warranties

  1. The Service is provided "as is". The Operator disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, accuracy, completeness, security, and continuity.
  2. The Operator does not warrant that the Software will detect every secret, piece of personal data, or risky action, that it will produce no false positives, or that it will run without defects in your environment.
  3. The Software does not provide legal advice, a security audit, or any assurance of compliance.

9. Limitation of Liability

  1. Except in cases of the Operator's wilful misconduct or gross negligence, the Operator is not liable for any damage arising from the use of, or inability to use, the Service.
  2. Where the Operator is liable, and except in cases of wilful misconduct or gross negligence, liability is limited to direct and ordinary damage actually incurred by you, and excludes lost profits, loss of data, business interruption, third-party claims, and any indirect, special, incidental, or consequential damage.
  3. Because the Software is provided free of charge, the Operator's total liability is capped, to the extent permitted by law, at the amount you paid the Operator for the Service (zero for free use).
  4. This section applies only to the extent it is not restricted by the Japanese Consumer Contract Act or other mandatory law.

10. Indemnification

If the Operator receives a claim from a third party or suffers damage because you breached these Terms or used the Service to infringe a third party's rights, you will resolve the matter at your own responsibility and expense and compensate the Operator for resulting damage, including reasonable attorney's fees.

11. Changes to the Service

  1. The Operator may change the Software's features, supported environments, or distribution methods, change the Site's content, or suspend or discontinue the Service without prior notice.
  2. The Operator makes no commitment to maintain, patch, or preserve compatibility for past versions of the Software.

12. Changes to These Terms

  1. The Operator may revise these Terms when it considers this necessary. Revised Terms take effect when posted on the Site.
  2. The Operator will make reasonable efforts to announce significant changes on the Site or in the repository's release notes.
  3. Using the Service after a revision constitutes acceptance of the revised Terms.

13. Governing Law and Jurisdiction

  1. These Terms are governed by and construed in accordance with the laws of Japan.
  2. Any dispute between the Operator and you concerning the Service is subject to the exclusive jurisdiction of the Japanese district court having jurisdiction over the Operator's location, as the court of first instance.

14. General

  1. If any provision of these Terms is held invalid or unenforceable, the remaining provisions remain in effect.
  2. If the Japanese and English versions of these Terms differ, the Japanese version prevails.
  3. The Operator's failure to exercise a right under these Terms is not a waiver of that right.

15. Contact

Questions about these Terms can be raised through the repository's GitHub Issues. Issues are public, so do not include secrets, credentials, or personal data. Report security vulnerabilities privately by following SECURITY.md rather than opening an issue.