Go modules have no license field in go.mod. Tools detect a module's license by finding files such as LICENSE or COPYING and matching their text against known licenses. That is a heuristic. Unusual file names or edited license text can defeat it, so verify anything your policy depends on.
How pkg.go.dev does it
The Go package site documents its approach. It detects licenses using heuristics based on file name and contents, with the licensecheck library. It only looks in files with particular names, such as LICENSE, LICENCE, COPYING and UNLICENSE, matched case insensitively. The site says unusual file names or modified license text can prevent detection, and that undetected licenses lead to limited information being shown. It gives no guarantee of accuracy and describes the information as an aid for evaluating packages, not legal advice.
Treat that as a model for any file based detector, including the one in your own scanner.
Where this goes wrong
| Situation | Effect on detection |
|---|---|
| License in a file named differently | May be missed |
| Text edited by the author | May fail to match |
| Multiple licenses in subdirectories | Module level answer can hide them |
| Vendored code with its own license | Easily overlooked |
| Nested modules in one repo | Each needs its own check |
A practical routine
- Read your go.sum or module list to get exact versions, including indirect modules.
- Run license detection on the module cache or vendor directory, not only on the top level.
- For modules with no detected license, open the repository and read the files.
- Record unresolved modules as unknown and review them under your policy.
- If you vendor, scan the vendor directory, because that is what you actually ship. See when to vendor dependencies.
Heuristic detection is fast and mostly right. The failures cluster in exactly the odd cases a legal review would care about, so build a review path for them instead of hoping they do not occur.
Try it yourself
Click through it at your own pace, or open it full screen.
Scan the inventory for components with incomplete metadata and note how you would route them to review.
Remember that a detection result is evidence, not a verdict. If your product depends on a Go module that a tool could not classify, the right move is a person reading the files, then writing the answer down. That one note saves the next team from repeating the search.
Safeguard offers dependency scanning and SBOM output, and a free scan lets you see results for a repository.
Quick check
Does pkg.go.dev guarantee its license detection is correct?
No. The site states detection is heuristic and gives no guarantee of accuracy.
Why scan the vendor directory?
It holds the code you actually ship, and vendored copies can carry licenses a top level check misses.
Sources
- Go package discovery site, license policy: https://pkg.go.dev/license-policy
Last reviewed: 19 October 2026.
