Short answers: open source is free of charge but not free of conditions, MIT asks you to keep its notice, code with no license is not free to reuse, and copyleft depends on how you ship. Each answer below points to a source text. This is general information, not legal advice.
Quick answers
| Question | Short answer |
|---|---|
| Is open source free to use in a product? | Usually free of charge, with conditions that vary by license |
| Does MIT ask anything of me? | Yes, include the copyright and permission notice in copies |
| Can I use a repo with no license? | GitHub says without a license, default copyright applies and no one may reproduce, distribute or create derivative works |
| Does BSD 3 Clause let me use the author's name in marketing? | No, not to endorse or promote without written permission |
| Does Apache 2.0 give me the project's trademark? | No, section 6 says it does not |
| Does hosting GPL code trigger source sharing? | By the GPLv3 text, network interaction alone is not conveying |
| What is different about AGPL? | Modified versions used over a network must offer source to remote users |
| Does an SBOM have to list licenses? | The NTIA minimum seven fields do not include license |
Longer notes
Open source versus free of conditions. The Open Source Definition requires free redistribution and source availability, but individual licenses add terms such as notice duties or copyleft.
No license means no permission. GitHub documentation says that without a license, default copyright laws apply, so you retain all rights and no one may reproduce, distribute or create derivative works. That applies in reverse when you consider using someone's unlicensed repo. See github repo has no license.
Notices are a real duty. MIT, BSD and Apache all ask for notices on redistribution. See building a notices file.
Copyleft depends on delivery. Shipped code is treated differently from hosted code, and each license family differs. See does running GPL software in your SaaS mean sharing source.
Investors ask for evidence. Policy, inventory and exception log. See what investors ask about open source licenses.
What to do this week
- Generate an SBOM for each shipped artifact.
- Write a one page policy.
- Name an approver.
- Start an exception log.
- Book time with counsel on anything flagged.
Safeguard's SBOM and dependency scanning can produce the first inventory, and there is a free scan at gold.safeguard.sh/scan.
Quick check
Which source should I trust over a blog post?
The license text itself, then your counsel. Posts like this one are orientation, not advice.
What is the first step if I know nothing about our dependencies?
Generate an inventory. Every other question depends on knowing what is in the product.
Sources
- Open Source Initiative, Open Source Definition
- Open Source Initiative, MIT license
- Open Source Initiative, BSD 3 Clause license
- Apache License 2.0 text
- GitHub Docs, licensing a repository
- Open Source Initiative, GPL 3.0 text
- Open Source Initiative, AGPL 3.0 text
- NTIA, The Minimum Elements For a Software Bill of Materials
Last reviewed: 19 October 2026.
