Research software should carry an explicit license. Without one, the code is under exclusive copyright by default and nobody else may safely copy, modify or distribute it. MIT is short and permissive. GPLv3 requires that distributed versions stay open source. This is general information, not legal advice.
What no license means
The Choose a License project states that when you make a creative work, which includes code, it is under exclusive copyright by default. Unless you include a license that says otherwise, nobody else can copy, distribute or modify the work without risk. Once others contribute, each becomes a copyright holder, so "nobody" starts to include you.
A public repository is not the same as an open license. GitHub's own archiving guidance tells you to include a license so readers know how they can reuse your work.
Two common choices
| License | In plain words | Consider it when |
|---|---|---|
| MIT | Short, permissive, lets people do almost anything, including closed source versions | You want maximum reuse and few conditions |
| GNU GPLv3 | Lets people do almost anything except distribute closed source versions | You want improvements to stay open |
Choose a License lists both with examples of projects that use them. There are many others, and some funders or institutions set their own policies, so check with your research office or technology transfer team before you pick.
Steps
- Check any funder, employer or institutional requirement first.
- Check the licenses of your dependencies. A strong copyleft dependency can constrain what you may choose. See do transitive dependency licenses matter.
- Add a LICENSE file at the repository root with the full text.
- State the license in your package metadata and in your CITATION.cff file context or README.
- If you depend on something with no license, ask its maintainers to add one, as Choose a License advises.
Why security teams care
License text decides who can redistribute your code, who can fix it and who can include it in a product. An unlicensed dependency in a research pipeline is an unknown, which belongs on the same risk list as an unmaintained one. See blank license field treat it as unknown.
Quick check
Is code on a public GitHub repository free to reuse?
Not without a license. By default the author holds exclusive copyright, so reuse is risky until a license says otherwise.
Can I change the license later?
Often you can for future releases, but contributors may hold copyright in their parts. Ask your institution or a lawyer before relicensing.
Safeguard's SBOM and dependency scanning can surface the licenses of your dependencies, and a free scan is available.
Sources
- No License, Choose a License
- Choose an open source license
- Referencing and citing content, GitHub Docs
Last reviewed: 19 October 2026.
