# Third-party notices

Original ScopeGuard code is MIT licensed. That license does not relicense third-party code, model weights or assets.

## Embedding model

- Model: **Xenova/all-MiniLM-L6-v2**, ONNX conversion of **sentence-transformers/all-MiniLM-L6-v2**.
- Pinned revision: `751bff37182d3f1213fa05d7196b954e230abad9`.
- License: **Apache License 2.0**, declared in the model's own card metadata, verified by fetching the pinned card. Local copy: `MODEL-CARD.md`.
- Source/card: https://huggingface.co/Xenova/all-MiniLM-L6-v2/tree/751bff37182d3f1213fa05d7196b954e230abad9
- Base model: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2
- License terms: `TRANSFORMERS-APACHE-2.0.txt` contains the standard Apache 2.0 terms; these are also available at https://www.apache.org/LICENSE-2.0 .
- We do not claim authorship of, alter, or redistribute model weights in this source folder. The app downloads the quantized ONNX artifact on explicit request.

## Transformers.js

- `@huggingface/transformers` **3.7.2**, Hugging Face and contributors.
- Apache License 2.0. Actual package license saved in `TRANSFORMERS-APACHE-2.0.txt`.
- Browser bundle: https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.7.2/dist/transformers.min.js
- Source: https://github.com/huggingface/transformers.js

## ONNX Runtime

- Browser runtime supplied by the Transformers.js build, with its package metadata declaring `onnxruntime-web` **1.22.0-dev.20250409-89f8206ba4**.
- MIT License, Copyright (c) Microsoft Corporation.
- License text saved in `ONNX-RUNTIME-MIT.txt`, fetched from https://raw.githubusercontent.com/microsoft/onnxruntime/v1.22.0/LICENSE . The package-root CDN LICENSE URL returned 404, so this is the upstream v1.22.0 license, not a recovered dev-package license file.
- Source: https://github.com/microsoft/onnxruntime

This is primary dependency attribution, not an exhaustive software bill of materials or legal audit of every bundled transitive component. CDN and model assets are version/revision pinned but not protected by browser subresource-integrity hashes. Review upstream notices before redistribution or production use.