Network and egress
A Cerberon instance contacts only the endpoints on this page. It sends no telemetry or analytics, and the console loads no third-party fonts or scripts.
In the product, Settings > Privacy and Network > Outbound Endpoints shows the live list with a reachability check from your host.
While Cerberon runs
Section titled “While Cerberon runs”| Endpoint | Used for | If blocked |
|---|---|---|
license.cerberon.dev |
Licence activation, lease refresh, release downloads | Licensing and in-app updates stop. Evaluation mode still runs. |
api.osv.dev |
Dependency advisory matching (ecosystem, name and version only) | SCA lists components without advisories and marks the result incomplete. |
www.cisa.gov |
CISA Known Exploited Vulnerabilities catalogue | The known-exploited flag is not set. |
api.first.org |
EPSS exploit prediction scores | No EPSS score or percentile is shown. |
endoflife.date |
End-of-life dates for the CBOM (product name only) | No end-of-life date is inferred. |
repo1.maven.org |
Maven parent and BOM resolution | Transitive Maven dependencies may be under-counted. |
These endpoints are yours and are contacted only when you use the feature:
| Endpoint | Used for |
|---|---|
| Your AI provider | Agent-assisted scans and AI review |
| Your identity provider | OIDC or SAML sign-in |
| Your Git hosts | Cloning repositories and listing them for a connection |
| Your container registries | Pulling images for a container scan |
| Your scan targets | The scan itself |
| Your webhook URL | Signed notification delivery |
| Your update channel, if configured | Release and rule-pack checks |
During installation and updates
Section titled “During installation and updates”These are contacted by the machine that runs the installer. The running instance does not contact them.
| Endpoint | Used for |
|---|---|
license.cerberon.dev, *.r2.cloudflarestorage.com |
Licence-gated downloads and the tools recipe |
registry-1.docker.io, ghcr.io |
Base and published images |
download.docker.com and your distribution’s mirrors |
Docker Engine and OS packages |
deb.debian.org, pypi.org, proxy.golang.org, registry.npmjs.org |
Packages inside the tools image |
github.com, raw.githubusercontent.com |
Pinned tool sources |
The installer downloads itself again on every update, so keep license.cerberon.dev reachable. An unreachable address is named at the start of installation with what it affects.
What leaves the host
Section titled “What leaves the host”- Feed lookups carry package identifiers and public data, never your source code.
- AI requests are masked at egress when the privacy policy is on. See AI providers and privacy.
- The licence service stores no IP address or user agent.