Licence audit before selling a SaaS

This page explains how these licences are commonly read. It is not legal advice; for a product decision with money on it, ask a lawyer who handles open source.

What a buyer usually wants to see

• A list of every open source component with its licence: the SBOM.
• Confirmation that no strong or network copyleft (GPL, AGPL, SSPL) ships in a way that would affect the product.
• Licence texts and notices kept as the permissive licences require.
• Anything unusual flagged, such as non-commercial, source-available or unknown licences, with a note on how it is used.

Produce it in one run

npx -y https://licensegate.org/dl/licensegate.tgz --mode saas --prod \
  --sbom sbom.cdx.json --notices THIRD_PARTY_NOTICES.txt --json licences.json

Pick the mode that matches the deal. Use saas for a hosted product. If the buyer will ship your code to their customers, run it again with --mode distributed. For each review line, write one sentence explaining how the package is used, for example “dev-only” or “separate process, unmodified”. Those sentences answer most of the follow-up questions.

Agencies and freelancers

Client contracts often say you won’t deliver code under licences that restrict the client. Run licensegate with --fail-on review in the project’s CI from day one, and the handover inventory is ready when the project ends.