An SCA tool can tell you which license a package declares and sometimes which licenses appear in its files. It cannot tell you whether your use is compliant. Treat the output as an inventory for your legal team, not as a decision.
Declared versus detected
Declared licenses come from package metadata, which maintainers fill in. Detected licenses come from scanning file headers and license files. They can disagree. A package may declare one license in its manifest and ship a file under another.
A good tool shows both and flags mismatches. A weak one shows only the declared value and calls it done.
A note on what standards claim
The SPDX overview says the standard collects and communicates facts and provides a framework for making assertions about them, while making no legal interpretations of licenses. The same attitude applies to your tooling. The data says what the files say. What it means for your product is a legal question.
Common gaps
- Packages with no declared license
- Dual licensed packages, where you may choose
- License expressions that combine terms
- Files copied from other projects under different terms
- Licenses that changed between versions
For each, the tool should surface the case, not guess.
What to test
Take ten packages whose licenses you already know, including at least one with a mismatch if you can find one. Check that the tool reports them right. Check that it handles missing licenses by marking them unknown, not by leaving them blank.
Policy features worth having
- A list of license families your company approves, restricts, or bans
- Different rules for different products, since a hosted service and a distributed binary have different obligations
- Exceptions with an owner and an expiry date
- Reports your legal team can export
What to leave to counsel
Interpretation of copyleft obligations, compatibility between licenses, and the effect of how you link or distribute are legal questions. Give counsel the inventory and ask for rules, then encode those rules as policy. Do not invert that order.
Keep it in the same inventory
License data and vulnerability data attach to the same component list. If both come from one scan, fewer things can drift out of sync. See the difference between an SBOM generator and an SCA scanner.
Safeguard's dependency scanning covers license findings alongside vulnerabilities, with policies you can set. Try the free scan at https://gold.safeguard.sh/scan.
A simple operating routine
Run the license report at each release and compare it with the last one. New licenses in the diff are the items worth a human look. Keep a short list of decisions your counsel has already made, so repeated questions get quick answers. When a package has an unknown license, treat that as a blocker for new adoption and as a ticket for existing use. This routine is cheap, and it catches the most common surprise, a dependency update that quietly changes terms.
Quick check
If a tool says a package is permissive, can I stop checking?
Not for anything with legal weight. Use the report as a lead and confirm with counsel.
Sources
Last reviewed: 19 October 2026.
