License policies

Mark licenses allowed, needing review, or denied, by SPDX id or by category; get findings for dependencies that break the policy; record legal approvals.

MergeHarbor knows the license of each package version in your inventories, from the lockfile or SBOM when it says, and otherwise from the package registry. Vulnerabilities → Inventory → Licenses lists the licenses in use, how many packages and repositories use each, and what your policy says about them.

Set a policy

Under Vulnerabilities → Settings → License policies → Edit policies, give a decision to a license by its SPDX id (GPL-3.0-only) or to a whole category:

Category	Examples
Permissive	MIT, Apache-2.0, BSD-3-Clause, ISC
Public domain	CC0-1.0, Unlicense
Weak copyleft	LGPL-2.1-only, MPL-2.0, EPL-2.0
Strong copyleft	GPL-2.0-only, GPL-3.0-or-later
Network copyleft	AGPL-3.0-only
Source available	BUSL-1.1, SSPL-1.0
Unknown	no license found

Each decision is allowed, review or denied, with optional instructions shown on the finding (“Ask legal before shipping”, “Replace with an MIT alternative”). A rule for a specific license wins over its category.

Packages under a denied license become high-severity license findings; review licenses become medium findings. They have SLAs, owners, tickets and exceptions like every other finding. For a dual-licensed package (MIT OR GPL-3.0-only), the most permissive choice counts.

Without any policy, no license findings are created.

Legal approvals

When legal clears a package, add an approval under License approvals: the package, optionally one version, and the license. The matching findings close, and the approval is recorded with who added it.