HOW IS OPEN-SOURCE SOFTWARE LICENSED IN DELIVERED CODE?

288 views

open-sourcelicensingsbom

Permissive licences only by default (MIT, Apache-2.0, ISC, BSD). Copyleft (GPL-style) flagged on the proposal. SBOM delivered with code.

Default policy

Code we deliver uses permissive open-source licences only by default:

MIT, Apache-2.0, BSD (2 or 3 clause), ISC, 0BSD, Unlicense

These licences impose minimal obligations beyond attribution and let you commercialise the work without licence contagion.

Copyleft and weak-copyleft

If a problem genuinely requires a copyleft component (GPL, LGPL, AGPL, MPL), we flag it on the proposal before including it. You decide whether the obligation fits your business model.

Software Bill of Materials

Every code delivery includes an SBOM in CycloneDX format listing every direct and transitive dependency, its licence, and its known-vulnerability status at the time of delivery.

What we never ship

Code under no licence (which is implicitly all-rights-reserved)
Vendor code stripped of attribution
Code with known critical CVEs in transitive dependencies that we have not noted in the SBOM

Was this helpful?

Tell us honestly. It is read by the people who write these pages.

If this didn't answer your question, ask Xylo.

Back to Ownership & Licensing