Most license trouble is not malice — it is a clause nobody read until the product shipped. This is the field guide to the gotchas that turn a "free" dependency or model into a compliance fire-drill: copyleft reach, source-available bans, missing patent grants, and the AI-specific traps that did not exist five years ago.
Copyleft licenses (the GPL family) grant you broad rights — on the condition that you pass the same freedoms downstream. When copyleft code becomes part of a larger work you distribute, that obligation can reach into your code: you may owe complete corresponding source under the same license. "Contamination" is informal shorthand; the legal pivot is whether you have created a derivative work and whether you distribute (or, for AGPL, convey over a network).
"Permissive" (MIT, BSD, Apache-2.0) does not mean "obligation-free." These licenses are easy precisely because their one real duty — carry the notices — is easy to forget. And permissive does not mean universally compatible: two permissive-ish licenses can still conflict.
A growing class of licenses publishes the source code but is not open-source under the OSI definition, because they restrict who may use it or how. The code is readable on GitHub — which lulls teams into treating it as free. Read the actual terms before you build a product on it.
| License | What it actually restricts | Open source? | Safe for a commercial SaaS? |
|---|---|---|---|
| SSPL Server Side Public License | If you offer the software as a service, you must open-source your entire service stack (management, automation, hosting) under SSPL. Designed to stop cloud providers from reselling. | No (rejected by OSI) | No — service-layer copyleft |
| BSL 1.1 Business Source License | An additional use grant caps or forbids production / competing use until a Change Date (often 4 years), when it converts to an OSS license. Until then, production use can require a commercial license. | Not until Change Date | Only within the use-grant |
| Elastic v2 (ELv2) | Free to use — except you may not provide it as a hosted/managed service and may not circumvent license-key functionality. Targets managed-service competitors. | No | No managed-service offering |
| Commons Clause rider on another license | Bolted onto an OSS license to remove the right to "Sell" the software — including selling a product whose value derives substantially from it. | No (negates OSS) | No selling / hosting-for-fee |
| CC BY-NC Creative Commons Non-Commercial | Allows reuse only for non-commercial purposes. Frequently attached to datasets, docs, icons, and model weights — not just art. Bundling it into a paid product is commercial use. | No (non-free) | No — blocks commercial use |
Copyright permission is not patent permission. A license can let you copy and modify code while saying nothing about the patents that code might practice — leaving you exposed to an infringement claim from the very author who "open-sourced" it. And licenses that do grant patents often attach a self-defense trigger.
Model weights are not code, and their licenses are not OSS licenses. Many "open" models ship under behavioral / responsible-AI licenses or vendor community licenses that restrict fields of use, resale, and who may use them. Then there is a second, separate question almost everyone conflates: the rights to the training data are not the rights to the model.
Some risks are not in any single clause — they come from what licenses omit, from your dependency tree changing under you, or from a project changing its terms after you have committed.
Almost every trap on this page is invisible until ship day — and then it is a customer-facing crisis. A focused review turns "we think we're fine" into a documented, defensible answer before the demand letter, the enterprise procurement questionnaire, or the due-diligence data room asks for it.
Apex Vanguard AI IP consulting — $400/hour, senior IP & open-source compliance review tailored to what you actually ship. Or start continuous self-service license scanning with Vanguard IP-Researcher.