License miscompliance issues

Abstract: The license compliance scanner detects non-permissive and copyleft licenses in open-source dependencies, protecting your organization by keeping license obligations you cannot meet out of distributed software.

The license compliance scanner safeguards your software supply chain by identifying the license attached to every open-source package your applications consume. Organizations consume hundreds or thousands of open-source packages, each governed by a license that imposes obligations on use, modification, and distribution. By detecting non-compliant licenses at code-time, the license compliance scanner closes the gap between open-source consumption and organizational license policy, preventing licensing fees, derivative work disclosure obligations, and commercial use restrictions from attaching to shipped software through a dependency that no one reviewed.

The Licenses page displays license compliance issues detected in open-source dependencies through Software Composition Analysis (SCA).

The Licenses page consolidates all scanner-detected license miscompliance issues across monitored repositories into a single view where you prioritize, investigate, remediate, and track SLA compliance.

Prerequisites

Prerequisite	Description
License	An active Cortex Cloud license with the Application Security module active for the tenant
RBAC role	The app_sec_issues_view permission, or an equivalent role that grants access to Application Security issues
VCS integration	At least one Version Control System (GitHub, GitLab, Bitbucket, Azure Repos) integrated as a data source
SCA scanner	The SCA scanner enabled for the integrated repositories. The license compliance scanner (CAS_LICENSE_SCANNER) runs as part of the SCA scanning pipeline
Completed scan	At least one completed periodic scan or PR scan. License issues are detected during the SCA phase of the scan

Note: A third-party SCA scanner typically provides vulnerability detection and may provide license compliance. Verify license coverage before relying on a third-party scanner for license posture. For third-party scanners, refer to Third-party ingestion.

Workflow

Use these guides to work through license miscompliance issues:

• Understand the Licenses misconfigurations table
• Investigate, prioritize, and remediate license miscompliance issues
• View and understand license micompliance findings
• Open-source software license categories

Core achievements and use cases

Shifting compliance left. Detecting non-compliant licenses at code-time during periodic and PR scans, before the affected package reaches production deployment, reduces the cost of removal — a dependency replaced during development is a code change, while the same dependency replaced after distribution may require a disclosure or a renegotiated license.

Accelerating legal review. Each license issue surfaces the SPDX license identifier, the license category, the dependency type, and the package manager, which enables the legal team to prioritize review by obligation severity rather than reading every dependency manifest. The license category classifies each finding as a strong copyleft license found in code, a weak copyleft license found in code, or a non-permissive license found in code.

Reducing legal risk exposure. Identifying strong copyleft, non-permissive, and unknown licenses isolates the dependencies that impose derivative work obligations, commercial use restrictions, or unquantified legal risk from the permissively licensed majority that requires no review.

Establishing compliance baselines and policy enforcement. Mapping open-source dependencies to OSI approval status, SPDX recognition, and the detection rules that matched (BC_LIC_1 through BC_LIC_5) creates a measurable and auditable compliance posture. Apply policies to the License Miscompliance finding type to define how the platform responds, including blocking CI runs or pull requests. For policy configuration, refer to Unified Application Security Policies.