Safeguard
Security Guides•

Is a source available license the same as open source?

No. Source available means you can read the code, but terms that limit use or competition fail the Open Source Definition. Here is a quick test to apply.

Safeguard Security Team
4 min read

No. Source available means the code is visible, but open source has a specific definition. If a license limits who may use the software or what they may use it for, it fails the Open Source Definition. You can still use such code, but your policy should treat it separately.

Definition

"Source available" is a descriptive term, not a license family. It covers any license where the source is published but the terms add limits. The Open Source Definition (OSD) states that open source does not just mean access to the source code, and then lists ten criteria. Source available licenses usually fail at least one.

The three-question test

Ask these of any license that calls itself open.

  1. Does it restrict a field of endeavor? OSD criterion 6 says the license must not restrict use in a specific field, and names business use as an example. A ban on commercial use, or on offering the software as a competing service, restricts a field.
  2. Does it discriminate against persons or groups? Criterion 5 forbids it.
  3. Does it need an extra agreement? Criterion 7 says rights must apply to everyone who gets the software without an additional license.

If any answer is yes, the license is not open source under the OSD.

What it means for your team

QuestionOpen source licenseSource available license
Can you read the code?YesYes
Can you use it in any business?YesDepends on terms
Can you redistribute modifications freely?YesOften limited
Standard identifier on a list you trust?UsuallySometimes a custom text
Review pathNormal tieringCounsel review

Read the actual text. Do not rely on a repository badge or a README sentence.

A short handling procedure

  1. Detect: flag licenses that are not in your approved list or that look custom.
  2. Read: find the clause that limits use, competition or hosting.
  3. Match to use: internal tool, shipped product, hosted service, or build time dependency each hit the clause differently.
  4. Decide: approve with conditions, replace, or reject.
  5. Record the decision with an expiry date so it is rechecked.

If a license changes after you adopted a dependency, repeat the process for the new version rather than assuming the old terms apply. For the change itself see our post on what to do when a dependency relicenses.

Try it yourself

Use the demo below to open a component and read its recorded license. Look for fields that are blank or nonstandard, because those are the ones that fail the quick test above.

Click through it at your own pace, or open it full screen.

Safeguard's dependency scanning and SBOM generation create the inventory, and policies and gates let you hold a pull request until a nonstandard license is reviewed. Try a free scan at gold.safeguard.sh/scan. This is not legal advice.

Quick check

Can I use source available software in a commercial product?

It depends on the license text. Read it for limits on commercial use or competing services before you adopt it.

Is "free to view" the same as "free to use"?

No. Viewing the code and the rights to use or redistribute it are separate questions answered by the license.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.