Workflow
Bring imports, license evidence and approvals into one workflow. Publish the reviewed record and keep it current.
Import
Import from GitHub, GitLab, or Azure DevOps auto-sync, or 10+ lockfile and SBOM formats
Every import classifies packages as new, updated, or unchanged first, so you see exactly what will land.
Import from repo auto-sync or upload CycloneDX SBOM, npm (package-lock.json), pnpm (pnpm-lock.yaml), Yarn (yarn.lock), Bun (bun.lock), Go (go.mod), Rust (Cargo.lock), Python (uv.lock, poetry.lock), NuGet (packages.lock.json), Maven (pom.xml), Gradle (gradle.lockfile), Composer (composer.lock), Bundler (Gemfile.lock). Each row is a license you must satisfy. Add fonts, icons, SDKs, and manual entries automated imports miss. Nothing is “done” until a human confirms the license; imports start as needs review.
mainweb/package-lock.jsonapi/uv.lockcore/Cargo.lockNeeds review
Distribution context
Set SaaS, binary, or library context. SourceTrust surfaces the license risks that apply.
This choice is not cosmetic. It changes which compatibility warnings and license obligations appear.
You declare how the product is distributed: Hosted service, shipped binary, library, or a mix. That choice changes which compatibility warnings and obligations appear, because AGPL in a SaaS backend is a different legal question than AGPL in an internal tool.
queue-workerAGPL-3.0Review the AGPL network clause before this package goes live.
Keep license and copyright notices
Guided review
Safe, verified packages clear in bulk. The rest stay gated until the license, text, and obligations are resolved.
One click clears every permissive package with verified text and no open obligations, and says exactly why it skipped the rest.
One package at a time with a progress bar and Approve, Skip, or Park. Each shows a plain-language situation card: What the system saw, and the single next action.
License law splits into notices we render for you and the manual steps only your team can take, each with a what-this-means-for-you explainer. The Publish button stays gated until they're ticked.
Match SPDX-style licenses, not raw manifest strings. Auto-fetch license text, bulk-approve safe licenses, and surface copyleft and distribution risk from the catalog. Full license text is required before publish for notice-bearing terms. External duties must be acknowledged or publish is blocked.
4 packages need attention.
charting-libGPL-3.0Share the source if you ship this package to customers.
Publish
Each project gets a branded public attestation page from reviewed inventory; link from docs, trust centers, and RFP responses. Only approved packages with complete license text appear. Publish is blocked until your team has verified what you represent.
View attestation pagesourcetrust.app/acme/platformEvery component on this page passed Acme Inc's review: license confirmed, license text on file, obligations acknowledged.
Generate disclosure, NOTICE, JSON, PDF, CycloneDX, and SPDX exports from the same frozen snapshot as the live page. Download into repos, attach to releases, or archive for audits. Exports include provenance and the public URL when published.
NOTICEJSONPDFCycloneDXSPDXOrg-wide compliance dashboard, cross-project inventory search, and audit trail for compliance-relevant changes. Published vs Testing branch lanes for connected projects. License catalog maintained without redeploy.
Each project’s page and exports describe that product only. Obligations do not bleed across projects.
Free to import and review. No credit card needed.
Cookies on sourcetrust.dev
We use essential cookies for security, including abuse prevention on our site scan and walkthrough request form. With your permission, we also use optional analytics and diagnostics (Google Tag Manager on this site, and the Sentry browser SDK on the SourceTrust application when configured). See our cookie policy.