Often yes, but the license decides how. OSV.dev lists the license of each source database, and they range from CC0, which asks for nothing, to CC BY 4.0, which requires attribution, to share-alike terms. Read the license for each feed you redistribute, and ask counsel before you ship the data inside a product.
Why this question comes up
Teams build their own scanner glue, mirror a database for offline use, or include advisory text in customer reports. Each of those copies the data. Copying triggers the license terms, so it is worth five minutes to read them.
This post is general information, not legal advice. For anything you redistribute, have counsel confirm.
What the licenses look like
The OSV.dev data sources page lists the license next to each database it aggregates. Examples from that page include the GitHub Advisory Database under CC BY 4.0, the Python advisory databases under CC BY 4.0, the Go vulnerability database under CC BY 4.0, the Rust Advisory Database under CC0 1.0, the OpenSSF malicious packages data under Apache 2.0, and a Linux distribution database under CC BY SA 4.0.
| License family | What it generally asks | Practical effect |
|---|---|---|
| CC0 | Nothing | Use freely |
| Apache 2.0, MIT, BSD | Keep notices | Include the notice |
| CC BY 4.0 | Give credit, indicate changes | Attribute in docs or reports |
| CC BY SA 4.0 | Credit and share derivatives under same terms | Review before redistributing |
Check the current text on each project's page, since licenses can change and a list like this one is a snapshot.
Three common situations
Running a scanner internally. You read the data and show results to your own team. Obligations are usually light, but keep a record of which sources you use.
Mirroring a database offline. You are now holding a copy. Keep the license file with it and respect attribution terms. OSV publishes bulk exports for this purpose.
Putting advisory text in customer reports. If you quote descriptions in a report you hand to customers, you are redistributing. Add attribution, and think about linking to the source record instead of copying it.
A simple routine
- List every data feed your tooling reads.
- Record the license for each, with a link and the date you checked.
- Mark any that you copy, store or redistribute.
- Add attribution lines to docs and report templates where needed.
- Re-check yearly, or when a feed changes hands.
What about a commercial scanner
A commercial tool normally bundles the data, and the terms are in its contract. Ask the provider which sources it uses, how it meets their licenses and whether you may export findings freely. That is a fair question and a good one to put in writing. Safeguard's SBOM and dependency scanning lets you export your own inventory, and you can try it on a free scan at https://gold.safeguard.sh/scan.
Quick check
Do I need to credit a vulnerability database in a customer report?
If the license is CC BY 4.0 and you reproduce its content, attribution is generally expected. Linking to the record is a simple way to comply, but confirm with counsel.
Does a license on the data change the license of my own code?
The data license applies to the data. Share alike terms can reach derivatives of the data, so review those cases specifically.
Sources
- OSV.dev, Data sources
- GitHub, Advisory Database README
Last reviewed: 19 October 2026.
