A license scan report lists each dependency with the license the scanner detected, usually as an SPDX identifier. To read it, check four things per row: which package and version, which license, where the scanner found that license, and whether the package ships to users. Unknown and custom rows need a human.
The columns that matter
Most reports look different, but nearly all carry the same core fields. Learn these and any report becomes readable.
| Column | What it tells you | What to ask |
|---|---|---|
| Package and version | The exact component | Is this version the one we actually ship? |
| Detected license | An SPDX identifier or an expression | Is it on our allowed list? |
| Evidence source | Package metadata, a LICENSE file, or a file header | Do the sources agree? |
| Scope | Runtime, development or build only | Does this reach customers? |
| Direct or transitive | Who pulled it in | Can we swap the parent? |
The evidence source is the column people skip. A license declared in package metadata and a license found in the text of a LICENSE file can disagree. When they do, the file text is usually the better evidence, but record which one you relied on.
Reading the license value
Most registries now ask publishers to use SPDX license expressions. The npm documentation, for example, shows a value like (ISC OR GPL-3.0) as valid syntax, and says to use a string such as SEE LICENSE IN with a file name for custom licenses. The Python packaging specification describes a License-Expression field that holds a valid SPDX expression.
So you will see three shapes in a report:
- A single identifier, such as MIT.
- An expression with OR, which means the user may choose, or AND, which means both apply.
- A free text value or a pointer to a file, which a scanner cannot classify on its own.
The third shape is where most manual work lands.
A first pass in three buckets
Do not read the report top to bottom. Sort it.
- Allowed. Licenses your policy already approves. Spot check a few and move on.
- Needs review. Licenses with conditions you must act on, such as notice requirements or source offers.
- Unknown or custom. No license, a blank field, a custom text, or a scanner that could not decide.
Then filter each bucket by scope. A review item in a build tool that never ships is a lower priority than the same license in a runtime library inside your product.
What a report cannot tell you
A report states what was detected. It does not say whether your use creates an obligation, because that depends on how you combine and distribute the code. Treat the report as the inventory that feeds a decision, and take hard calls to your legal counsel.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each dependency row carries its version and where it came from.
Safeguard's SBOM and dependency scanning produce the inventory a license review starts from, and you can run a free scan at gold.safeguard.sh/scan.
Quick check
Is a license shown as OR a problem?
Usually not. OR means the user may choose between the licenses, so record which one you chose.
Should I trust metadata or the LICENSE file?
When they disagree, read the file text, then note the disagreement and the choice you made.
Sources
Last reviewed: 19 October 2026.
