License scanning finds the license each dependency declares, reports it in a standard form, and flags items your policy does not allow. It does not decide your obligations. These ten short answers cover the questions that come up most when teams first read a report.
The ten answers
1. What does a scan detect? The license of each component, from metadata, license files or headers, usually as an SPDX identifier.
2. What does unknown mean? The tool could not identify a license. One may exist. Open the package and read it.
3. Is no license the same as free to use? No. GitHub's documentation says that without a license the author retains all rights.
4. What does OR mean in an expression? The user may choose. npm documents the form (ISC OR GPL-3.0) as valid. Record your choice.
5. What does AND mean? Both licenses apply to the component. Satisfy both.
6. Are permissive licenses obligation free? No. MIT asks that its notice be included in copies or substantial portions. Apache adds change notices and NOTICE file handling.
7. Do transitive dependencies count? Yes. They ship with your product like any other component.
8. Do dev dependencies count? Only if they end up in what you distribute. Check the build output.
9. Can a license change between versions? Yes. Record the exact version you reviewed.
10. Is a scan legal advice? No. It is an inventory. Hard calls belong with counsel.
A two minute reading plan
- Filter to runtime scope.
- Sort by status: deny, review, unknown, allow.
- Open one example from each bucket.
- Confirm the policy covers each license that appears.
- File anything missing as a policy gap.
How often to scan
Run it on pull requests that change dependencies, and again on a schedule, since policy and advisories change. See how often to scan licenses.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each component is listed with its version and source.
Safeguard offers SBOM and dependency scanning, and a free scan is at gold.safeguard.sh/scan.
Quick check
Does a clean scan mean I meet every license?
No. It means nothing in the policy was flagged. Notices still need to ship.
What is the first thing to fix?
Unknown and no license items in shipped code, since nothing is granted for them.
Sources
- GitHub: licensing a repository
- npm package.json license field
- MIT License text, OSI
- Apache License 2.0
Last reviewed: 19 October 2026.
