thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Open Source License Compliance

Ensuring that use of open-source components follows the obligations of their licenses.

Definition

Permissive licenses (MIT, Apache 2.0, BSD) require attribution, while copyleft licenses (GPL, AGPL) may require releasing derivative source code. SCA tools and SBOMs identify licenses so legal teams can approve or block components. Non-compliance is a legal and intellectual property risk rather than a vulnerability.

Example

An SCA policy blocks AGPL-licensed libraries from a proprietary SaaS product.

Exam tip

SCA covers both vulnerabilities and license risk.

Related terms