Safeguard
Compliance•

What does the BSD 3-clause no endorsement rule mean for you?

BSD 3-clause adds one rule over BSD 2-clause: you may not use the author's name to promote your product without written permission. Notices still apply.

Safeguard Security Team
3 min read

The third clause of the BSD 3-clause license says you may not use the copyright holder's name or its contributors' names to endorse or promote products derived from the software without specific prior written permission. It is about marketing use of names. The notice duties in the first two clauses still apply.

The three conditions

The OSI text of the 3-clause license lists these conditions:

  1. Redistributions of source code must retain the copyright notice, the list of conditions and the disclaimer.
  2. Redistributions in binary form must reproduce the same notice, conditions and disclaimer in the documentation or other materials provided with the distribution.
  3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from the software without specific prior written permission.

Condition three is the "no endorsement" clause, and it is what separates this license from the 2-clause form.

What it changes in practice

It rarely blocks engineering. It matters in marketing and sales material.

  • Do not write "powered by" a project in an ad in a way that suggests the project endorses your product, without checking the permission point.
  • Factual statements, such as listing components in a third party notices page, are what condition two expects you to do anyway.
  • Do not use a contributor's personal name in launch copy as a reference for your product.

If you are unsure whether a specific marketing line crosses the line, ask your counsel. This post does not give legal advice.

Where scan reports mislead

Scanners often report BSD-2-Clause and BSD-3-Clause as simply "BSD". That loses the difference. Old packages also use the label "BSD" with no clause count. Open the license text and count the conditions, then record the right SPDX identifier. If a license has four conditions, including an advertising clause, it is a different license and should be treated as one.

A short checklist

  • Is the identifier BSD-3-Clause, or did the scanner only say BSD?
  • Does the shipped product reproduce the notice in documentation or other materials?
  • Does any marketing page use the project or contributor names as endorsement?
  • Is the notice kept when you vendor the code?

Quick check

Does BSD 3-clause require me to publish my source?

No. The text asks you to keep notices. It does not ask you to release your own source.

Can I name the library in my third party notices page?

Listing it to satisfy the notice condition is what the license expects. Endorsement claims are the concern.

Safeguard's dependency scanning and SBOM output give you the component list to check these notices against.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.