Safeguard
Security Guides•

Can you remove copyright headers from open source code?

Usually no. MIT and Apache 2.0 both ask you to keep copyright and license notices when you redistribute. Here is what to keep and what you may drop.

Safeguard Security Team
4 min read

Usually not. MIT says the copyright and permission notice must be included in all copies or substantial portions of the software. Apache 2.0 says you must retain copyright, patent, trademark and attribution notices in source form of derivative works, with limited exceptions. Stripping headers is a common cause of license breaches. Not legal advice.

Definition: what a notice is

A copyright notice names the author and year. A license notice states the terms. Many files carry both in a header comment, and many projects add a top level LICENSE file. The licenses treat these as conditions of your permission to copy and distribute.

What the licenses say

LicenseCondition on notices
MITThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software
Apache 2.0, section 4(a)Give other recipients a copy of the License
Apache 2.0, section 4(b)Modified files must carry prominent notices that you changed them
Apache 2.0, section 4(c)Retain, in the Source form of any Derivative Works, all copyright, patent, trademark and attribution notices from the Source form of the Work, excluding notices that do not pertain to any part of the Derivative Works
Apache 2.0, section 4(d)If the Work includes a NOTICE text file, include a readable copy of the attribution notices in it, in one of the allowed places

Apache 2.0 section 4(d) lists the places: a NOTICE text file distributed with the Derivative Works, the source form or documentation if provided, or a display generated by the Derivative Works wherever third party notices normally appear. It also says the contents of NOTICE are informational and do not modify the license.

What you can and cannot change

You may add your own copyright notice to your modifications, and you may add license terms for your own contributions, as long as your use of the Work as a whole follows the license conditions. You may not remove the original notices to make the code look like yours.

Two cases cause trouble:

  1. Bulk reformatting tools that strip leading comments. Check the diff before merging.
  2. Copying a file into your repo and deleting the header "to keep things tidy". This is the situation the notice conditions are written for.

The Apache text allows excluding notices that do not pertain to any part of the Derivative Works. That is a narrow carve out. Do not use it to justify wholesale removal.

Steps for a safe import

  1. Keep the original file header when you copy a file into your repository.
  2. Add a line recording the source project, version and license.
  3. Keep the LICENSE and NOTICE files from the project in a third party folder.
  4. Mark modified files with a short change note, as Apache 2.0 section 4(b) asks.
  5. Generate your product's third party notices file from this record.
  6. Configure your formatter and linter so they never strip license headers.
  7. Add a pull request check that flags a deleted header.

Try it yourself

Click through the pull request gate demo and see how a check blocks a merge. A rule that flags a removed license header is a small example of the same pattern.

Click through it at your own pace, or open it full screen.

Safeguard's policies, gates and guardrails can enforce rules on pull requests, and its SBOM and dependency scanning list the components you ship. A free scan is available at gold.safeguard.sh/scan.

Quick check

Is it fine to delete the header if I credit the project in my README?

Not safely. MIT asks for the notice to be included in copies, so keep the original header or notice with the code.

Can I add my own copyright line to a modified file?

Yes, you may add your own notice for your changes. Keep the original ones.

What is a NOTICE file?

An Apache 2.0 file of attribution notices. If the Work includes one, you must carry its notices forward in an allowed place.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.