15 minutes

Licensing, SBOMs & AI-Era Software Risk

Open source is leverage. This is how you use it deliberately.

77% of the code in a typical app isn't yours.

96% of commercial codebases contain open source
Open source files in the average app have tripled since 2020 — 5,386 → 16,082
Many carry known, registered vulnerabilities

It's the default way software gets built now — and it comes with terms. Respect them.

Black Duck OSSRA 2024–25

Where we're going

What a license actually obligates
Permissive vs. copyleft
Where obligations hide — and what to do
How AI piles up dependencies — and vulnerabilities
SBOMs: knowing what you ship

Foundations

A license is a permission structure

Rights granted

Use
Copy
Modify
Distribute

Obligations imposed

Notices & attribution
Source disclosure
License compatibility

Internal use and distribution trigger different obligations.

The landscape

Two families

Permissive

MIT · BSD · Apache-2.0

Low-friction: do almost anything
Just keep notices & attribution

Copyleft

GPL · LGPL · AGPL · MPL

Share-alike: changes stay open
Strong vs. weak scope
AGPL triggers on network use

"Dangerous" doesn't mean bad — it means requires context and review.

Plain-English terms for any license → tldrlegal.com

The obligations

What each license actually makes you do

License	Keep notice	State changes	Disclose source	Same license	Network = dist.	Copyleft reach	SaaS risk
MIT	✓	—	—	—	—	none	none
BSD-3	✓	—	—	—	—	none	none
Apache-2.0	✓	✓	—	—	—	none	none
MPL-2.0	✓	—	✓	✓	—	file	low
LGPL-3	✓	✓	✓	✓	—	library	low
GPL-3	✓	✓	✓	✓	—	program	low
AGPL-3	✓	✓	✓	✓	✓	network	HIGH

✓ = required · SaaS risk = must you reveal source just for hosting it? · Sources: choosealicense.com, tldrlegal.com · not legal advice

Surface area

Where obligations actually show up

Rarely the dependency you meant to add. Usually everything around it.

Direct and transitive dependencies
Containers & base images
Vendored code and copied snippets
Build tools vs. runtime components
SaaS vs. distributed — changes what even triggers

Remediation

Found a risky license? Work the question

First: how is it used — distributed, hosted, linked, bundled, modified, or dev-only?

Then pick a path:

Keep it — with the compliance steps done
Replace, isolate, or remove before release
Buy a commercial license
Escalate to legal review

AI-assisted development

You still own what you can't see

Obscurity. The further you drift from the code, the easier it is for dependencies you never chose to get pulled in — and the AI isn't checking whether their licenses are even compatible with your app.
Unknown trust. You don't know these are established, safe packages. They can be abandoned, vulnerable, or typosquatted.
Provenance. You can't tell where generated code, snippets, or configs actually came from.

You can't inventory what you didn't know you added.

The exposure

The pile-up is real

log scale · advance to reveal linear

CVEs affecting open-source packages Source: OSV.dev · counted by CVE id-year (vintage), last complete year shown.

Inventory

An SBOM is an ingredient list

A Software Bill of Materials: every component in what you ship, as a machine-readable document — SPDX or CycloneDX.

One entry, annotated

{

"type": "library",

"name": "left-pad", what it is

"version": "1.3.0",

"supplier": { "name": "azer" }, who it came from

"licenses": [{ "id": "WTFPL" }], the terms

"purl": "pkg:npm/left-pad@1.3.0", unambiguous identity

"dependsOn": [ … ] the graph

}

abridged CycloneDX

Why you'll need one

Customer security reviews & procurement
Regulatory / audit requests
Incident response & vuln impact analysis
License compliance reporting
M&A / due diligence

The habit

Make it workflow, not a last-minute scramble

Know what enters the codebase
Scan dependencies continuously
Review license policy before release
Track vulnerabilities alongside
Generate SBOMs from every build — keep the evidence

Closing

Respect the work

Almost everything you ship was written by people you'll never meet, and given away for free. The license is what they asked for in return. Respect it, and know what you've actually taken.

Licenses set the terms
The obligations follow the code everywhere you use it
Vulnerabilities pile up the same way
An SBOM is how you see what you've got