Terms of service

The service is operated by Bytkit (“we”). Reach us at [email protected]. These terms are governed by the law of the State of Delaware, United States of America, and the courts there have exclusive jurisdiction over any dispute about them.

Rivet reads repositories you have given it access to, checks their dependencies against public advisory databases, and, when you ask it to, or when you have put a repository in watch mode, upgrades packages in a sandboxed copy, edits code the upgrade breaks, runs your tests, and opens a draft pull request.

• It never merges anything. There is no code path that merges.
• It never pushes to your default branch. Work lands on its own branch.
• It acts on a repository only when asked, or when that repository is in watch mode.
• If it cannot produce a green result, it opens no pull request and says why.

• You must have the right to grant access to the repositories you connect, and to let their contents be processed as described in the privacy notice.
• You review every diff. A passing test suite is evidence, not a guarantee. Rivet opens drafts precisely so a person decides.
• Keep your account secure, and do not use the service to attack anyone, to process repositories you have no right to, or to evade the limits on it.

The service is provided as is. We do not warrant that it will find every vulnerability, that an upgrade it produces is correct, that it will be available continuously, or that a result will be reproducible. A report that finds nothing is not a certificate that a repository is safe, Rivet says so on the report itself, and it is true here too.

To the fullest extent the law allows, we are not liable for indirect or consequential loss, lost profits, or lost data arising from your use of the service. Where liability cannot be excluded, it is limited to the greater of the fees you paid us in the twelve months before the claim, or US$100.

Runs cost real money to execute, so they are bounded: a limited number of attempts per run, caps on how much a run may spend, and a cap on how many repositories one batch may start. Scanning is free and unlimited on every plan. What you pay for is fixing. Current pricing is on the pricing page.

• Paid plans are billed in advance, monthly or annually, and renew automatically until you cancel. Payments are taken by our payment provider, who is the seller of record for the transaction and whose terms also apply to it.
• Each plan includes a number of fix runs per billing period. Past that, runs are charged at the overage rate on the pricing page, or stop, depending on the plan.
• A run that fails still counts. It used the sandbox and the models either way. A run we refuse to start, because you are over a limit or a repository is paused, does not count and is not charged.
• Cancel whenever you like, from the dashboard. Cancelling stops the next renewal and you keep the plan until the end of the period you have paid for. We do not refund part-used periods.
• If a first payment was a mistake, tell us within 14 days and we will refund it. Changing plan takes effect immediately and the difference is prorated.
• We will tell you before a price change affects a renewal.

Uninstall the GitHub App at any time and everything stops immediately. We may suspend an account that is abusing the service or costing far more than its plan allows, and will say why. Pull requests already opened are yours: they stay in your repository until you close or merge them.

These terms may change as the product does. The date at the top is the version in force. Continuing to use the service after a change means accepting it.