Industry Watch · Published May 30, 2026
Open Source Licence Risk: Used, Not Understood
Nearly every project uses open source, yet few can explain its obligations.
We audit client projects now and then and find surprises: GPL components inside commercial products, libraries unmaintained for three years. Open source saves development cost and carries ignored duties.
Common risks
Copyleft: GPL and AGPL require derivative works to be open-sourced under the same terms, which can breach agreement in closed-source products.
Stalled maintenance: unmaintained dependencies stop receiving fixes and break upgrade paths.
Unclear provenance: snippets from forums or cloud drives carry no licence, so risk cannot be assessed.
What can be done
Keep a dependency inventory generated by scanning tools, updated each release and annotated with licences.
Draw red lines: no AGPL in core business code, no code without clear licensing.
Review key dependencies annually: recent activity, known vulnerabilities, viable alternatives.
Open source is not a free lunch but conditioned sharing. Treat licence duties like contract clauses and use it with confidence.
Want to apply these ideas to your project?
We are happy to go deeper into implementation details, or to discuss the specific questions you are facing.
Start a conversation →