A startup with no security team can handle open source license compliance with four habits: keep an inventory of dependencies, write a short allow, deny and review list, send unknown licenses to one named person, and generate attribution notices at release. Start with the list, not a tool.
This is practical guidance, not legal advice. Ask a lawyer about specific obligations.
Why does a startup need this at all?
Three events make licenses matter: a customer's security or procurement review asks for your open source list, an acquirer or investor runs diligence, or you ship software to customers and owe them notices. None of these gives you months of notice.
The licenses themselves differ in what they ask. Permissive licenses mostly ask you to keep notices. Copyleft licenses can require you to share source under the same terms. The AGPL-3.0 summary on choosealicense.com states that running a modified version as a network service triggers the source requirement, which matters for SaaS in a way the older GPL did not.
What does a minimum program look like?
Four parts, each small.
1. An inventory. You cannot manage licenses you cannot list. An SBOM in SPDX or CycloneDX is the usual format. SPDX also gives you license identifiers: its overview recommends them because they are precise, language neutral and machine readable. The SPDX License List had more than 690 licenses and exceptions as of June 2025.
2. A policy of three lists. Allow: licenses you accept without asking, such as common permissive ones. Deny: licenses you will not take into a proprietary product or a hosted service. Review: everything else, including unknown. Keep the policy to one page.
3. One owner for the review queue. Pick a person, usually the engineering lead, and a response target. Without an owner, unknown licenses sit in a backlog until a customer asks.
4. A release step. For anything you distribute, produce a notices file with the required attributions and license texts, and keep the SBOM for that release.
What about compound license expressions?
SPDX expressions can combine licenses with OR, AND and WITH exceptions. An OR means you can choose, so a policy engine should pick the option that fits your list. An AND means you owe both. If you read these by hand, you will make mistakes at scale. A scanner that parses SPDX syntax saves time.
What can tools do, and what can they not?
A scanner can detect licenses from package metadata, license files and headers, and flag conflicts. It cannot decide what a license means for your product. Safeguard's license compliance docs describe detection from several signals, a license discrepancy finding when signals conflict, YAML allow, deny and require-review lists, and enforcement in CI and pull requests. The same docs state plainly that classification depends on available signals and that you should consult counsel on obligations. They also note there is no CLI command yet for generating attribution documents, and that safeguard scan writes a license.json file with its results.
Whatever tool you pick, test it on your own repository and look at the unknowns.
What is the standard to aim for later?
OpenChain maintains ISO/IEC 5230, described on its site as the international standard for open source license compliance programs, and offers a free self-certification checklist. You do not need it on day one. It is a useful outline of what a mature program contains when a large customer eventually asks.
What to do
- Generate an SBOM for each product and store it with the release.
- Write a one-page policy with allow, deny and review lists.
- Name a review owner and a response time.
- Add a CI check that fails on deny-listed licenses and flags unknown ones.
- Produce a notices file with every release you distribute.
- Record exceptions with an approver, a reason and an expiry date.
- Once a year, review the policy with a lawyer.
Quick check
Do I need to worry about licenses if I only run a SaaS?
Yes, though differently. Network copyleft licenses such as AGPL-3.0 can require source sharing when a modified version runs as a service. Check each dependency against your policy.
What do I do with a package that has no license?
Treat it as review required. No license generally means no permission to use, so ask the author, replace the package, or get legal advice before shipping.
Sources
- SPDX overview
- choosealicense.com: GNU Affero General Public License v3.0
- OpenChain Project
- Safeguard docs: License Compliance
Last reviewed: 18 October 2026.
