Several myths about open source licenses show up again and again in deals. Free of charge does not mean free of conditions, the MIT license does ask for a notice, and code with no license is not free to use. The facts below come from the license texts and platform documentation, not from opinion.
Myth versus fact
| Myth | Fact |
|---|---|
| Open source means no conditions | Each license has its own conditions. Even permissive ones usually require notices. |
| MIT needs nothing from me | The MIT text says the copyright and permission notice shall be included in all copies or substantial portions of the software. |
| A public repository with no license is free to use | GitHub's documentation says that without a license, default copyright law applies and the creator keeps all rights. |
| Apache 2.0 is just like MIT | Apache 2.0 adds an express patent license and redistribution conditions such as keeping NOTICE attributions. |
| A license field proves the license | The field is a claim by the package author. It can be missing or wrong. |
| Copyleft always spreads to everything | It depends on the license, how the code is combined and whether it is distributed. This is a legal question, so ask counsel. |
| Scanning finds everything | Scanners see declared dependencies. Copied code, assets and embedded libraries can be missed. |
Taking the table apart
Free does not mean unconditioned. Price and permission are separate. A zero price tells you nothing about the terms.
Missing license is not a permission. When a repository has no license, the safe assumption is that you have no right to reuse the code beyond what the platform terms give you. See GitHub repository has no license.
Permissive is not the same as obligation free. Notices are a small task, but a task that gets forgotten. See MIT attribution: what to ship.
What to do about it
- Write the facts into your policy instead of relying on memory.
- Make notices part of your release checklist.
- Treat unknown licenses as a finding, not as a pass.
- Add a manual check for copied code and assets.
- Send any copyleft question to counsel with the facts about how the code is used.
Why this matters in a deal
Most deal friction comes from surprise, not from the licenses themselves. A seller with a clean inventory and a notices file rarely has a hard conversation. A buyer who understands the table above asks sharper questions and settles for less noise.
Safeguard supports policies, gates and guardrails, so a team can decide which findings block a pull request and which only warn. A free scan is available if you want to see your own dependency list first.
Quick check
Is MIT licensed code safe to use commercially?
The MIT text permits broad use, with the notice condition. Read it for your case and keep the notice.
Can I assume a repository is usable if it is on GitHub?
No. GitHub says that without a license the creator keeps all rights.
Sources
Last reviewed: 19 October 2026.
