Tech Stack and Licenses

Tech Stack & Licenses

Backend

Package	License	What it's for
fastapi, uvicorn	MIT, BSD-3-Clause	Web framework and ASGI server
pydantic, pydantic-settings	MIT	Request/response validation, typed env-var config
sqlalchemy[asyncio], asyncpg	MIT, Apache-2.0	Async ORM and Postgres driver
alembic	MIT	Schema migrations
msal	MIT	Microsoft Graph / Entra token acquisition (client-credentials for mailbox access)
pyjwt[crypto]	MIT	Verifies Entra SSO id_tokens (PyJWKClient against the tenant's real JWKS)
cryptography	Apache-2.0 OR BSD-3-Clause	Fernet encryption for secrets at rest, and RSA/Ed25519 key parsing for the DKIM checker
argon2-cffi	MIT	Local-auth password hashing
pyotp, qrcode	MIT, BSD-3-Clause	TOTP enrollment and verification for local auth
email-validator	Unlicense	Email address format validation
parsedmarc	Apache-2.0	Parses DMARC aggregate/forensic and TLS-RPT report XML/JSON — used as a library only, not its CLI or Elasticsearch output writers
dnspython	ISC	Low-level DNS primitives the checkers are built on
httpx	BSD-3-Clause	HTTP client — Graph API calls, MTA-STS policy file fetches
python-multipart	Apache-2.0	Pulled in by FastAPI for optional form-data parsing; not used directly anywhere in this app
pytest, pytest-asyncio	MIT, Apache-2.0	Test suite (backend/requirements-dev.txt, dev-only — not part of the deployed runtime)

Frontend

Package	License	What it's for
react, react-dom	MIT	UI
react-router-dom	MIT	Client-side routing
@tanstack/react-query	MIT	Server-state fetching/caching
lucide-react	ISC	Icons
vite, @vitejs/plugin-react	MIT	Build tooling (dev-only — not part of the deployed runtime)
typescript	Apache-2.0	Type checking (tsc -b runs as part of every build)

Every package actually shipped to the browser (react, react-dom, react-router-dom, @tanstack/react-query, lucide-react, and their own transitive dependencies) is MIT or ISC — fully permissive.

Infrastructure

Component	License	What it's for
PostgreSQL 16	PostgreSQL License (permissive)	Primary datastore; row-level security is what actually enforces tenant isolation
mvance/unbound	BSD-3-Clause	A dedicated, DNSSEC-validating resolver every check query goes through, kept separate from the host's own resolver so its cache behavior can be tuned independently (see resolver/overrides.conf)
Docker Compose	Apache-2.0	Orchestration — no Kubernetes, no message queue; a single worker replica is enough at this scale

Every dependency is exact-pinned (==, not a range) in backend/requirements.txt and frontend/package.json — deliberate, not an oversight: a range lets a future npm install/pip install silently pull in whatever's newest at that moment, good or compromised. New dependencies should be pinned to their current latest stable/LTS release, never a range and never a preview/RC build.

---

← Architecture & Internals · Home