# Third-party components

This service uses Androguard 4.1.4 (Apache-2.0), FastAPI (MIT), Uvicorn (BSD-3-Clause), React (MIT), Vite (MIT), and the Sites-generated UI component dependencies. Individual dependencies retain their respective licenses; Python distributions and npm packages include their license metadata/files in the installed environment. Complete resolved dependency inventories are in uv.lock and frontend/package-lock.json.

Androguard source: https://github.com/androguard/androguard
License: https://github.com/androguard/androguard/blob/master/LICENCE-2.0

Androguard is the parsing engine. The similarity algorithms and thresholds in this service are custom implementation choices and are not an official Androguard similarity standard.

Public APK fixtures are downloaded separately from the fixed upstream commit listed in tests/fixtures.lock.json, verified by SHA-256, and are not included in the distributable source archive. Fixture results are software validation examples, not analysis of the user's apps.

The local service does not deploy the Sites scaffold to Cloudflare. The production UI is a static local bundle served by FastAPI; no cloud storage or project was provisioned.

The v2 iOS and deep-analysis engine inventory is documented in THIRD_PARTY.md and engine-manifest.json.