Yes, it can happen. An assistant that was trained on public code may suggest text that matches existing public code, along with its license obligations. Some tools check suggestions against public code and either block or flag matches. Those checks reduce the risk but do not remove it, so keep a review step.
How matching checks work
Take GitHub Copilot as one documented example. Its documentation says that in Block mode, each suggestion, together with about 150 characters of surrounding code, is checked against public code on GitHub, and if there is a match or near match the suggestion is not shown. In Allow mode, matching suggestions can appear, with details of the match and links to the source repositories. For people on an organization seat, the setting is inherited from the organization or enterprise.
A related feature, code referencing, records details such as matching file URLs and any detected licenses when you accept an unchanged inline suggestion that matches public code. The stated purpose is to help you review source and licensing, then decide whether to use, attribute or remove the code.
Two limits are visible in that description. The check covers public code on one platform, and it looks for a match or near match. Code adapted from a private source, a different host, or reworded heavily may not trigger it. Other assistants have their own settings, so check the tool you use.
Why licensing exposure matters
A copyleft license can place conditions on how you distribute code that includes it. A permissive license usually asks for attribution. Either way, you cannot meet an obligation you do not know about. For background see what a copyleft license is.
A practical control set
| Control | What it covers |
|---|---|
| Block matching suggestions where the tool allows it | Reduces matches reaching your editor |
| Review any match details the tool shows | Lets a person decide use, attribute or remove |
| License scanning of dependencies | Catches licenses of packages the assistant adds |
| Snippet or similarity checks in review for large pasted blocks | Covers what the tool check misses |
| Written exceptions process | Keeps decisions recorded |
Steps when a match is flagged
- Open the match details and read the source repository and license.
- Decide whether the license suits your product and distribution.
- If yes, add the attribution and notices the license requires.
- If no, remove the block and write it yourself or choose a compatible library.
- Record the decision in the pull request.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM that includes license metadata, and policies can gate a pull request on a license rule. A free scan shows what your repository already contains.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the pull request gate and look at how a rule blocks a merge until it is satisfied.
Quick check
Does Block mode guarantee no licensed code gets in?
No. It compares against public code on GitHub and handles matches or near matches. Other sources and heavy rewording can slip past.
Do I need to disclose a match?
That depends on the license. Many require attribution and notices when you keep the code. Ask counsel if unsure.
Sources
Last reviewed: 19 October 2026.
