What teams assume vs. what licenses require

Open source does not mean no legal obligations.

It means the obligations are standardized, public, and enforceable, often without anyone on the team having read them.

• Assumption

  “It’s open source. We can ship it.”

  Reality

  Every component comes with conditions. Permissive licenses still require copyright and license notices in distributions. Copyleft licenses can require source offers, license propagation, and distribution analysis. Not a footnote on a wiki.

• Assumption

  “We’re SaaS, so licenses don’t apply.”

  Reality

  Some obligations are lighter for network-only use; many are not. GPL, LGPL, Apache attribution in installers, font redistribution, and asset attribution still matter. And customers still ask what you ship and what you bundle.

• Assumption

  “Legal will handle it if it’s important.”

  Reality

  Legal cannot operationalize what engineering never inventoried. Package lists change every sprint; fonts, icons, and SDKs often never appear in them. By the time counsel is looped in, the release is already out.

• Assumption

  “We have a LICENSE file in the repo.”

  Reality

  Your repo’s license is yours. Not your dependencies’. A single attribution file from three years ago does not describe what customers download today.

• Assumption

  “npm update is just a patch, compliance stays the same.”

  Reality

  A version bump can change the effective license, add copyleft, or swap obligations entirely. Routine updates are one of the most common ways compliance breaks without anyone noticing.