Software and source use policy
VietLicenSure is provided free of charge but is not released under an open-source licence. This page explains the change introduced in v4.9 and the current terms in SOURCE-POLICY-v5.0.
1. Status and controlling source
SOURCE-POLICY-v5.0, updated 2 November 2026. VietLicenSure now discloses a selected set of non-core modules as proprietary source-available material; this is not an open-source licence.If introductory material differs from the policy document, the current repository policy controls. Each release identity must still be verified using the manifest, checksums and signature bundled with that exact package.
2. Rights to use the official executable
Permitted
- Download and use the unmodified official executable free of charge.
- Use it lawfully for personal, educational, research, community and internal organisational purposes.
- Share the official download link so others can download and verify it themselves.
- Inspect the signature, SHA-256, manifest and provenance information.
- Submit defects, proposals, documentation, translations and feedback through official channels.
Written approval required
- Rehosting, mirroring or distributing files from another server or repository.
- Bundling with another product, selling, renting, charging for or commercialising it.
- Modifying, patching or reverse engineering to reuse code or create derivatives.
- Bypassing official-build verification, rebranding or impersonating the author.
- Removing or altering copyright, Build ID, signature, hashes or official-source information.
3. Controlled partial source
From 2 November 2026, a small set of reporting/offline policy, schemas and documentation verifiers is disclosed for independent inspection. The authoritative set is locked by PARTIAL-SOURCE-MANIFEST.json.
The disclosed files are proprietary source-available material, not GPL, MIT, Apache or other open-source code. UI, business logic, detection/remediation, elevated broker, plugin/update internals, build/sign pipelines and full test assets remain private.
4. Requesting source access
A request to study, research, review security or contribute at source level must be sent to thanhvietit.hopnghia@gmail.com and identify:
- Name, organisation and contact details.
- Specific purpose, expected outcome and requested source scope.
- Requested duration, approved persons, environment and safeguards.
- Any copying, build, modification or validation requirement.
- Agreement to the policy and additional conditions.
Access exists only after written approval. It is personal, non-transferable, limited by purpose/scope/duration and may be suspended or revoked when a violation or risk is found.
5. Limits on approved access
- Do not share accounts or expose source to unapproved persons.
- Do not copy source outside the approved environment, publish, mirror or upload it elsewhere.
- Do not bundle, integrate, create derivatives, serve third parties or commercialise it.
- Do not use source as training data or input to code-generation systems without approval.
- Do not remove attribution, rebrand, impersonate or prematurely disclose vulnerabilities.
6. Community contributions
Source access is not required to contribute defect reports, reproduction steps, feature proposals, documentation, translations, test cases, compatibility results or sanitised sample data.
Source-level contributions require written terms covering scope, branch/channel, quality gates, attribution, copyright and confidentiality. Sending an idea or patch does not transfer ownership automatically and does not grant rights to the remaining source.
7. Staged disclosure roadmap
| Indicative stage | Scope | Condition |
|---|---|---|
| Through November 2026 | Tightly controlled; limited review access by written approval. | Stabilise v5.0 and protect the release chain. |
| Through February 2027 | Non-core modules such as schemas, verifiers or sanitised fixtures may be published. | Internal checks and risk review pass. |
| Through June 2027 | Additional stable components may be considered. | Suitable independent assessment and no material abuse. |
| From July 2027 | Conditional expansion or a separate restricted licence may be considered. | Security, legal and maintenance reassessment. |
These dates are indicative rather than binding. Only a formal written publication changes a stage or grants additional rights.
8. Security and sensitive data
Do not publish product keys, tokens, credentials, personal/internal data, controlled source, sensitive reports or uncoordinated vulnerabilities. Submit vulnerabilities through GitHub Private Security Advisory or the official email channel.
9. Verifying an official build
Download only from the official repository/release and verify the version, Build ID, SHA-256, manifest, checksums, author and signature state. The current channel is Official Self-Signed: it uses the official pinned self-issued signer and a timestamp, but is not public-CA, EV or Microsoft Store signing.
10. Earlier versions, disclaimer and amendments
- Versions before v4.9 remain governed by their accompanying terms; previously granted valid rights are not changed retroactively.
- The software is provided as is, without warranty. Users are responsible for backups, source verification and compliance with law and organisational policy.
- Policy changes take effect only through official written publication. Technical access or accidental receipt of a copy is not permission.