To grade the potential compliance risks involved with different licenses, we assess them using a grading system. Keep in mind that the color grading simply represents the estimated amount and complexity of the compliance concerns. This does not mean that some licenses are riskier than others - if you understand all the compliance requirements of a license and are able to fulfill them, then the license is practically risk-free regardless of our grading.
The risk levels are created under the assumption that the installed dependency is not affected by external factors, including, but not limited to, interactions with other dependencies and effects of compilation. We advise you to adjust the risk levels based on your own internal policies, risk tolerance and use case.
RED | Banned license, high compliance risk, not allowed | Unknown license This grading is used for a license that is not allowed use in, e.g. in company or project context, or for a use-case reason (such as with GPLv3 in consumer electronics) because it will likely cause a breach of the license terms, hence exposing you for possible legal challenges. |
ORANGE | Restricted license with substantial compliance risks. Such licenses should only be allowed after getting some legal guidance and on a case-by-case basis, as the compliance considerations are generally difficult to fully comply with. |
YELLOW | Approved license, with sizable compliance considerations. In such licenses the source code must be made publicly available and there are restrictions in combining with other code under a different license, as with the licenses in the Copyleft license family. |
GREEN | Approved license, with few compliance considerations. In such licenses the copyright and permission notice must be maintained in distributions of code, as with most licenses of the Permissive license family. |
BLUE | Non-OSS / Commercial / Proprietary license |
To read more about license families, license risks, use cases, and compliance - check out our blog.
