Kevin from FOSSA here -- I hope it's clear that this would be completely against our policies and business model. However, if you're truly worried about this, you can install a fully on-prem version of FOSSA. Use of app.fossa.io with fossa-cli is also an opt-in feature, so by default you're not sending us any data.

Secondly, we deal entirely with 3rd-party code, so the licensing issues and risks are already completely public. If there was truly a malicious actor, they would just scan popular third party modules and reach out to companies that had job postings or github pages that were active in those environments (i.e. scan npm packages and target JS developers).

But in the spirit of good development practices, "security by obscurity" hasn't proved to be an effective strategy. We'd prefer not to promote "legal by obscurity" either. :)