For MIT code, keep the copyright notice and the permission notice with every copy or substantial portion. For Apache 2.0 code, keep the license text and carry forward the relevant NOTICE file content. This is a plain reading of the license texts, not legal advice. Ask counsel about edge cases.
MIT
The MIT license text, as listed by the Open Source Initiative, grants broad rights to use, copy, modify, merge, publish, distribute, sublicense and sell, and states one condition: the copyright notice and the permission notice shall be included in all copies or substantial portions of the software. The software is provided as is, without warranty.
For vendoring, that means the license text and the copyright line from the original must travel with the copied code. In practice that is the LICENSE file kept in the vendored directory, or the notice copied into your own third party notices file.
Apache 2.0
The Apache License 2.0 has more parts. In section 4, for redistribution of the work or derivative works, it asks you to give recipients a copy of the license, to mark modified files with prominent notices, and to retain copyright, patent, trademark and attribution notices from the source form. It then says that if the work includes a NOTICE text file, derivative works you distribute must include a readable copy of the attribution notices in that file, excluding those that do not pertain to any part of the derivative works. They can go in a NOTICE file with your distribution, in the source or documentation, or in a display your work generates where third party notices normally appear.
The license adds that the contents of the NOTICE file are informational and do not modify the license, and that you may add your own notices alongside, provided they cannot be construed as modifying the license.
At a glance
| Item | MIT | Apache 2.0 |
|---|---|---|
| Keep copyright notice | Yes | Yes |
| Keep license text | Yes, permission notice | Yes, a copy of the license |
| Mark changed files | Not required by the text | Yes, prominent notices |
| NOTICE file | Not part of the license | Carry forward relevant content |
| Where to put it | With copies or substantial portions | NOTICE file, docs or display |
A practical routine for vendored code
- Keep the original LICENSE and any NOTICE file inside the vendored directory, unedited.
- Maintain one third party notices file at the product level that lists each component, its license and its copyright line.
- For Apache code you changed, add a short change note at the top of each changed file.
- Check whether your build or packaging step drops these files. Minifiers and bundlers often strip comments.
- Record the license in your provenance file. See what a vendored provenance file should record.
Common slips
Copying only the code and not the license file. Replacing a copyright line with your company name. Forgetting that a fork on a hosting platform is also a copy. For fork specific points, see license obligations when forking and what to ship for MIT attribution.
Where Safeguard fits
Safeguard's SBOM and dependency scanning records components and license data that feed a notices file. It does not replace a legal review. Try a free scan at gold.safeguard.sh/scan.
Quick check
Is a NOTICE file the same as the license?
No. The Apache text says NOTICE contents are for information and do not modify the license. You still carry both.
Do bundlers affect these obligations?
They can. If minification strips the notices, the shipped output may lack what the license asks for, so check your build output.
Sources
Last reviewed: 19 October 2026.
