> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues.md).

# License miscompliance issues

> **Abstract:** The license compliance scanner detects non-permissive and copyleft licenses in open-source dependencies, protecting your organization by keeping license obligations you cannot meet out of distributed software.

The license compliance scanner safeguards your software supply chain by identifying the license attached to every open-source package your applications consume. Organizations consume hundreds or thousands of open-source packages, each governed by a license that imposes obligations on use, modification, and distribution. By detecting non-compliant licenses at code-time, the license compliance scanner closes the gap between open-source consumption and organizational license policy, preventing licensing fees, derivative work disclosure obligations, and commercial use restrictions from attaching to shipped software through a dependency that no one reviewed.

The **Licenses** page displays license compliance issues detected in open-source dependencies through Software Composition Analysis (SCA).

The **Licenses** page consolidates all scanner-detected license miscompliance issues across monitored repositories into a single view where you prioritize, investigate, remediate, and track SLA compliance.

### Prerequisites

| Prerequisite    | Description                                                                                                                                               |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| License         | An active Cortex Cloud license with the Application Security module active for the tenant                                                                 |
| RBAC role       | The `app_sec_issues_view` permission, or an equivalent role that grants access to Application Security issues                                             |
| VCS integration | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure Repos) integrated as a data source                                                  |
| SCA scanner     | The SCA scanner enabled for the integrated repositories. The license compliance scanner (`CAS_LICENSE_SCANNER`) runs as part of the SCA scanning pipeline |
| Completed scan  | At least one completed periodic scan or PR scan. License issues are detected during the SCA phase of the scan                                             |

> **Note:** A third-party SCA scanner typically provides vulnerability detection and may provide license compliance. Verify license coverage before relying on a third-party scanner for license posture. For third-party scanners, refer to Third-party ingestion.

### Workflow

Use these guides to work through license miscompliance issues:

* [Understand the Licenses misconfigurations table](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/understand-the-licenses-table.md)
* [Investigate, prioritize, and remediate license miscompliance issues](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/navigate-to-license-miscompliance-issues.md)
* [View and understand license micompliance findings](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/understand-license-micompliance-findings.md)
* [Open-source software license categories](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/open-source-software-license-categories.md)

### Core achievements and use cases

**Shifting compliance left.** Detecting non-compliant licenses at code-time during periodic and PR scans, before the affected package reaches production deployment, reduces the cost of removal — a dependency replaced during development is a code change, while the same dependency replaced after distribution may require a disclosure or a renegotiated license.

**Accelerating legal review.** Each license issue surfaces the SPDX license identifier, the license category, the dependency type, and the package manager, which enables the legal team to prioritize review by obligation severity rather than reading every dependency manifest. The license category classifies each finding as a strong copyleft license found in code, a weak copyleft license found in code, or a non-permissive license found in code.

**Reducing legal risk exposure.** Identifying strong copyleft, non-permissive, and unknown licenses isolates the dependencies that impose derivative work obligations, commercial use restrictions, or unquantified legal risk from the permissively licensed majority that requires no review.

**Establishing compliance baselines and policy enforcement.** Mapping open-source dependencies to OSI approval status, SPDX recognition, and the detection rules that matched (BC\_LIC\_1 through BC\_LIC\_5) creates a measurable and auditable compliance posture. Apply policies to the License Miscompliance finding type to define how the platform responds, including blocking CI runs or pull requests. For policy configuration, refer to Unified Application Security Policies.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.