Automated peace-of-mind you know what you’re shipping
Open-source software powers modern development. It's also a security and compliance minefield.
Every dependency you pull into your codebase comes with a license. Some are permissive and safe for commercial use. Others (e.g., GPL, AGPL or SSPL) carry obligations that can conflict with your business model, require source code disclosure or restrict how you deploy your software.
The challenge? Most organizations discover license issues after release, when remediation is expensive, time consuming and incredibly frustrating to the development teams tasked with rectifying issues.
With our newest release of Legit’s SCA scanning, we are helping customers tackle these challenges head-on.
The License Visibility Gap
From conversations with security and compliance teams, we consistently hear very similar feedback:
"We don't know what licenses exist in our dependency tree." Your application might depend on hundreds or thousands of open-source packages. Each has a license. Many have multiple licenses. Some change licenses between versions. Without a clear, consistent and automated process in place, you're flying blind.
"We can't enforce license policies at scale." Even when you identify problematic licenses, enforcing policies across dozens of teams and repositories is manual, inconsistent and error prone. Issues slip through which, again, leads to expensive late-stage rework.
"We find problems too late." License violations discovered post-release create a difficult choice: accept the legal risk or pull the dependency and potentially break your application. Neither of those are appealing options.
Organizations need the same rigor for license compliance that they apply to security vulnerabilities: automated detection, clear policies, and enforcement before code ships.
Legit License Scanning and Policy Enforcement
Legit's new SCA-based license scanning capabilities give you comprehensive visibility and control over open-source licenses across your entire codebase.
Automated License Detection
Our SCA scanner now identifies and classifies licenses for every open-source dependency in your applications. We handle the complexity:
- Multiple licenses per dependency: Some packages offer dual licensing (e.g., GPL OR commercial). We detect and surface all options.
- License changes between versions: Packages sometimes change licenses in newer versions. We track this so you know what you're really using.
- Unknown and custom licenses: When we encounter non-standard licenses, we flag them for review rather than silently ignoring them.
Every detected license is enriched with standardized properties that matter for compliance: copyleft requirements, commercial use restrictions, source disclosure obligations and patent grants.
Risk-Based Classification
Not all licenses carry the same risk. We classify licenses into four categories to help you prioritize:
- Permissive: Minimal restrictions, safe for most commercial use (e.g., MIT, Apache 2.0, BSD)
- Some Restrictions: Weak copyleft or specific requirements around distribution (e.g., LGPL, MPL)
- Restricted: Strong copyleft requiring source disclosure or commercial licensing (e.g., GPL-3.0, AGPL-3.0)
- Unknown: Licenses we haven't classified yet, requiring manual review
This classification gives you a starting point for policy decisions without requiring deep legal expertise from your engineering teams.
Policy-Based Enforcement
Define license policies once, enforce them everywhere. You can block builds based on:
- Specific licenses: Block GPL-3.0 and AGPL-3.0 while allowing Apache and MIT
- Risk levels: Block all "Restricted" licenses while allowing "Permissive" and "Some Restrictions"
- Custom rules: Build complex policies using our query language to match your organization's specific requirements
When a policy violation is detected, developers receive clear feedback directly in their pull request:
"Dependency foo-lib@1.2.3 uses AGPL-3.0 license, which is blocked by policy due to source disclosure requirements. To continue, use a different dependency or request an exception."
No legal jargon. No ambiguity. Just actionable guidance.
Break-Glass for Exceptions
We understand that license policies need flexibility for legitimate exceptions. Teams can request exceptions through:
- Ignore rules: Add specific dependencies to .legitignore for approved exceptions
- PR comments: Request exception review directly in the pull request workflow
- Audit trail: All exceptions are logged for compliance reporting
This gives you the control you need without blocking legitimate work.
Visibility Where You Need It
License information surfaces throughout the platform:
- In the Dependencies view, you can see all licenses in use across your organization, grouped and filtered by risk level, license type or affected repos.
- In PR checks, developers get immediate feedback when they introduce dependencies with problematic licenses, before code is merged.
- In custom policies, you can build sophisticated rules that match your organization's specific compliance requirements and risk tolerance.
- In exports and APIs, license data is available for integration with your compliance workflows and reporting systems.
Why This Matters
License compliance isn't just about avoiding legal risk. It's about enabling your teams to use open-source software confidently and responsibly.
With automated license scanning and policy enforcement, you can:
- Prevent compliance issues before they reach production: Catch problematic licenses in PR review, not after release
- Enable safe open-source adoption: Give developers clear guardrails so they can move fast without creating risk
- Demonstrate compliance posture: Show auditors and stakeholders you have controls in place
- Reduce remediation costs: Finding and fixing license issues early is dramatically cheaper than post-release remediation
Getting Started
License scanning is available now to all Legit customers as part of our SCA capabilities.
For existing customers: License detection is already running across your dependencies. You can enable policy enforcement in your SCA scanner settings and configure blocking rules based on your organization's requirements.
For new customers: License scanning is included in our AI-first Application Security Posture Management (ASPM) platform. Request a demo to see how we help organizations secure their AI-led pipelines across the entire software lifecycle.
