What this scan can and cannot tell you

It answers one narrow question: Does this public URL show obvious signs of third-party license disclosure, or obvious gaps? It helps teams who have never audited their marketing site find missing links, redirects to the homepage, or empty license pages.

For SaaS vendors, the marketing site is often the first place buyers look before they ask for the real license compliance page for the shipped product.

• HTTP responses on common license and notice paths (/license, /legal, /oss, etc.).
• Whether those pages contain plausible license or third-party notice text, not empty shells.
• Some third-party script URLs visible in homepage HTML.
• Obvious redirects that send license paths to unrelated pages.
• Missing links: No license footer, no open-source mention, no compliance URL in site map.

It cannot see what is not on the public page: License compliance for a shipped product lives in build inputs (lockfiles, SBOMs, release bundles), not on your homepage. A clean scan does not mean your mobile app, desktop installer, or API backend is documented.

The scan does not read transitive npm dependencies, verify SPDX identifiers, confirm full license text for each component, or know whether a human approved publish. That gap is large: Black Duck's 2025 OSSRA reports that transitive dependencies caused nearly 30% of the license conflicts it found, and none of those are visible from a homepage. It cannot replace third-party license disclosure tied to what you ship.

• Dependencies bundled in iOS, Android, desktop, or embedded products, not on the public web.
• Transitive packages never loaded in browser-facing JavaScript.
• Whether listed licenses match what actually ships in the product under review.
• Review and publish approval state: Gates, sign-offs, audit trail.
• Copyleft compliance: Source offers, corresponding source, distribution triggers.
• Fonts, SDKs, and icons not referenced on the scanned URL.
• Internal-only components or air-gapped delivery models.

The scan is a teaser that finds visible gaps on a single public URL; a license compliance page is the operational record: Reviewed inventory, full license text, attribution, a stable URL for procurement, and exports aligned with releases.

Teams pass a surface scan by adding a footer link to a thin notice page. Teams pass enterprise diligence by maintaining license compliance documentation per product, updated when dependencies change.

If the scan finds gaps, treat that as a prompt, not a failure. Build inventory from lockfiles or SBOMs for what you actually ship. Review licenses. Publish maintained disclosure you can share in whatever format diligence asks for.

If the scan looks clean, still ask whether the visible page covers the product under contract. Marketing site license footers and product license compliance pages are often different artifacts. Both may be needed; only one satisfies a request for third-party license disclosure on the shipped product.