Safeguard
Compliance•

Does an open source license let you use the project's name or logo?

Apache 2.0 says it grants no trademark rights, and BSD 3 Clause bars using contributor names to endorse. Here is what to check before naming a fork.

Safeguard Security Team
3 min read

Usually no. A software license covers the code, not the project's name or logo. Apache 2.0 says it does not grant permission to use the licensor's trade names or trademarks, and BSD 3 Clause bars using the names of contributors to endorse your product. Check trademark policies before naming a fork. Not legal advice.

What the license texts say

Apache 2.0, section 6, reads: this License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.

The BSD 3 Clause license has a third condition: neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from the software without specific prior written permission.

The MIT license text I fetched says nothing about names or marks. Silence is not permission. Trademark rules sit outside the license, and many projects publish separate policies.

Where this bites a startup

SituationRisk to check
You fork a project and keep its nameThe name may belong to the original project
Marketing says "powered by Project X"Descriptive use differs from implying endorsement
A customer logo wall includes open source logosLogos may have their own usage rules
Your app shows library names in creditsCredits are normally fine and often required as notices

Steps before launching a fork or a derived product

  1. Find the project's trademark or brand policy, often a page in the repo or on the foundation site.
  2. Rename the fork unless the policy allows the name.
  3. Keep copyright notices and license text as the license requires, which is separate from the brand question.
  4. Avoid wording that implies endorsement or partnership.
  5. Log the decision so you can show diligence later.

The post on security considerations in open source trademark policies looks at the topic from a different angle.

Why investors care

A product built on a fork can have two problems: license obligations and name rights. An acquirer will read the repo and the website and compare them. If your site claims an association with an upstream project that you do not have, that is an easy question to ask. A short note in the data room that you checked the policy and renamed where needed answers it.

Safeguard's asset discovery and SBOM can show you which open source components power your products so you know which names to review. The rights question remains a matter for counsel.

Quick check

Is it fine to say our product uses an open source library?

Descriptive statements of fact are generally treated differently from implying endorsement. Check the project's policy if you plan to use its logo or promote the relationship.

Does keeping the NOTICE file fix the name question?

No. Notices satisfy attribution duties. Names and marks are a separate matter.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.