Source available means you can read the code. Open source means the license meets the ten criteria in the Open Source Definition, including free redistribution, allowed modification, and no restrictions on who may use it or for what field. A license that fails any criterion is source available, not open source.
The ten criteria in plain words
The Open Source Initiative publishes the definition. In short:
- Free redistribution. Anyone can sell or give away the software, including in a bundle, without a royalty.
- Source code. The source is included or easy to get, in the form a programmer would edit, and not deliberately obfuscated.
- Derived works. Modifications are allowed and can be distributed under the original license's terms.
- Integrity of the author's source. Restrictions on modified source are limited to patch files, and derived works may need a different name or version number.
- No discrimination against persons or groups.
- No discrimination against fields of endeavor. Use cannot be barred in a field such as business or genetic research.
- Distribution of license. Rights apply automatically to everyone who receives the program.
- License must not be specific to a product.
- License must not restrict other software distributed alongside it.
- License must be technology neutral.
The terms that usually break the test
Most source available licenses fail on criterion 5 or 6, or on criterion 1. A clause that bans use in a competing service restricts a field of endeavor. A clause that bars a named kind of customer discriminates against a group. A clause that requires a paid license for commercial use breaks free redistribution.
These licenses can still be reasonable business choices. They are simply not open source by the published definition, and your obligations differ.
Why the label matters to you
Your policy may say "open source only" or may allow only specific licenses. If a dependency changes from an open source license to a source available one, the change can make it fall outside your policy. The first step is to read the actual license text, not the project's marketing page.
Also check what your own customers expect. Some procurement documents ask you to list open source components. Calling a source available component open source in a questionnaire is an inaccurate answer.
A quick test you can run
- Find the license file and its name. Is it on the OSI approved list? If you cannot confirm, treat it as unapproved until a reviewer checks.
- Read for any limit on who may use the code, what for, or where.
- Read for any fee or permission step for commercial use.
- Read for any limit on offering the software as a hosted service.
- Record the finding with the license file path.
For related reading on license shifts, see commercial open source license shift analysis.
Safeguard's SBOM and dependency scanning list your components so a reviewer knows which licenses to read, and you can try a free scan.
Quick check
Is code on GitHub automatically open source?
No. It is open source only if its license meets the Open Source Definition.
Is source available worse?
Not necessarily. It simply carries different terms, so apply the review your policy requires.
Sources
Last reviewed: 19 October 2026.
