Crypto Export Notice Lint (EAR 742.15)

It reads the export-control paragraph in your Markdown — README, EXPORT, NOTICE, SECURITY — and reports which of ten documented items are absent or wrong: the [email protected] and [email protected] addresses, the published source URL, an ECCN such as 5D002, the notification date, the removed 740.13(e) citation, and the line about re-notifying when the source moves.

Maintainers and founders who publish source code containing encryption from the United States: the person who tags a release of a password manager, an end-to-end messaging client, a database with encryption at rest, or an SDK that wraps libsodium or OpenSSL. Also the security engineer who inherits that repository and its export paragraph.

Because the paragraph most assistants reproduce cites License Exception TSU at EAR 740.13(e), which BIS removed in the encryption rule of 20 September 2016 and replaced with the notification in 742.15(b). A generative answer restates the text it learned; it cannot tell you that your own notice is dated 2019 and missing [email protected].

Checking the file open in your editor against all ten checks is free forever, with no key, no watermark and no run limit. The licence key covers a different axis: sweeping every Markdown file in the repository and writing a dated report file you own. That sweep also runs free for its first seven days.

Six findings on one ordinary-looking export paragraph — four errors and two warnings: no [email protected], no ECCN, a removed 740.13(e) citation, an EAR99 claim, a notification dated 2019-03-04 and no re-notify line. The clean notice shipped beside it returns zero. US export-control counsel is commonly quoted at 300-600 USD per hour.