Licences

Copyleft contaminants and policy violations, before they reach a release.

Planned Designed and scheduled, not yet built. Documented so the design can be reviewed early.

Every dependency’s licence, checked against a policy, with SPDX identifiers resolved from package metadata, repository files and licence text.

What it catches

A strong-copyleft dependency, AGPL or SSPL, pulled in transitively by something innocuous, in a product you ship as proprietary software. That is the case that costs money, and it is invisible until someone audits you or a customer’s legal team asks.

Also: licence changes between versions, which happen more often than people expect, and dependencies with no discoverable licence at all, which is its own risk because you have no grant to use them.

Configuring a policy

{
  "vulnetix.license.allow": "MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC",
  "vulnetix.license.mode": "inclusive"
}

inclusive treats the list as an allowlist: anything not on it is a finding. individual evaluates each licence on its own terms rather than against a list.

Signed-in organisations can set this centrally so every developer and CI run share one policy rather than each maintaining a copy.

Output for compliance

A licence report exports as SPDX, and the SBOM carries per-component licence data. Both are on SBOM and VEX.

Didn't find what you needed? Tell us what's missing · Ask a question · Edit this page