Safeguard
Developer Tools•

How does GitHub detect a repo license, and why do scans say other?

GitHub compares a repo's LICENSE file to a short list of known licenses. A modified or unusual file falls outside it, so tools report other or unknown.

Safeguard Security Team
3 min read

GitHub reads the repository's LICENSE file and compares it to a short list of known licenses using an open source tool called Licensee. If the file is edited, combined with other text or not a known license, the match fails and the repo shows as other or has no detected license. Many scanners behave similarly.

What the documentation says

GitHub's licensing documentation states that the open source Ruby gem Licensee compares the repository's LICENSE file to a short list of known licenses. It also says that without a license, default copyright laws apply, so no one may reproduce, distribute or create derivative works from the work.

Two practical points follow. A match is against known text. And a missing match is not evidence of freedom to use.

Why a real license fails to match

Common reasons a license that exists is not detected:

  • The file was edited, for example with extra paragraphs or a changed header.
  • Two licenses were pasted into one file.
  • The license sits in a different file name such as a docs folder or a header comment.
  • A custom or modified license was written, even if it looks like a standard one.
  • The repo has several licenses in subfolders.

In each case a human reading the file can often say what it is. The detector cannot.

What to do with an other result

  1. Open the file and read it. Is it a standard license with minor edits, or a different license?
  2. Find the closest SPDX identifier. If the text differs only in formatting, record the standard identifier.
  3. If the terms really differ, treat it as a custom license and record it with a LicenseRef style identifier. See recording licenses not on the SPDX list.
  4. If there are several licenses, list each one with the paths they cover.
  5. Note your conclusion with the commit you read.

The same pattern in other tools

Scanners that match file text against a known set behave much like GitHub's detector. They return a confidence or a closest match, and they return unknown when nothing fits. Your own review is the tie breaker for low confidence results.

For maintainers

If your own repository shows other, make detection easy. Keep a single unmodified LICENSE file at the root, add an SPDX identifier line to source headers, and put the license in your package metadata.

Quick check

Does an other label mean the code is unlicensed?

No. It means the detector could not match a known license. Read the file.

Is the GitHub label proof of the license?

It is a helpful signal, not a legal determination. Confirm with the file text.

Safeguard's SBOM and dependency scanning supplies the inventory where these other results show up.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.