No, not safely. A repository with no license has not granted anyone permission to use, copy, modify or distribute the code. Creative work, including code, is under exclusive copyright by default. Public visibility does not change that. Ask the author to add a license, choose an alternative, or negotiate terms.
Public does not mean permitted
It is easy to assume that code on a public page is there to be used. The guidance from choosealicense.com says otherwise: publishing code in a public GitHub repository means the author accepted GitHub's Terms of Service, which let others view and fork it. That does not mean you can use, change or share the code for any purpose. Site terms alone are not enough for the kind of collaboration an open source license enables.
Forking inside the platform is one thing. Copying the code into your product is another.
Why it matters for a company
If your product includes unlicensed code, you cannot show a right to use it. That can surface during a customer review, an acquisition diligence request, or a dispute. A missing license is also a gap in your software inventory, because there is no license to record and no conditions to follow.
Small utilities are the usual culprit. A developer finds a helpful snippet or a tiny package, and nobody checks the repository for a license file.
Three options
- Ask the maintainers to add a license. Open an issue and link to the guidance. The page says a missing license is probably an oversight unless the project indicates otherwise. Many authors fix it quickly.
- Avoid the code. Look for an alternative under an open source license, or write the functionality yourself from scratch without copying the original.
- Seek a private license. You can negotiate terms directly with the creators, with a lawyer's help.
Checks before you adopt anything
- Is there a LICENSE or COPYING file at the root?
- Does the package manifest declare a license field, and does it match the file?
- Are there license headers in the source?
- If the repository mixes folders, does each folder carry its own terms?
A manifest that declares a license while the repository has no matching file is a weaker signal than a full license file. Ask for clarity.
Building the habit
Put the check in your intake process. When someone proposes a new dependency, the review should record the license and its source, such as the file path. A policy that says "no license means no approval" is simple to apply and easy to explain.
Automation helps, but only when the inventory is complete. For more on the process, read how to audit open source licenses and what is license scanning.
Safeguard's SBOM and dependency scanning list the components in your project, and policies and gates can enforce your intake rules. You can try a free scan.
Quick check
Can I use unlicensed code if I credit the author?
Credit is not permission. Without a license you have no granted right to use the code. Ask the author for one.
Is a README note like "free to use" enough?
It is better than nothing but vague. Ask the author to add a standard license so the terms are clear.
Sources
Last reviewed: 19 October 2026.
