Extend Security Best Practices for your Project by UlisesGascon · Pull Request #3465 · github/opensource.guide

UlisesGascon · 2025-07-09T14:28:47Z

cc: @KevinCrosby, @Jeffrey-Luszcz @DUBSOpenHub @jonchurch @blakeembrey @ljharb @RafaelGSS

Note: This PR will impact #3462 and #3461

_articles/security-best-practices-for-your-project.md

UlisesGascon · 2025-07-09T14:31:42Z

_articles/security-best-practices-for-your-project.md

+
+Using open source dependencies can speed up development, but each package includes a license that defines how it can be used, modified, or distributed. Some licenses are permissive, while others (like AGPL or SSPL) impose restrictions that may not be compatible with your project's goals or your users' needs.
+
+Imagine this: You add a powerful library to your project, unaware that it uses a restrictive license. Later, a company wants to adopt your project but raises concerns about license compliance. The result? You lose adoption, need to refactor code, and your project’s reputation takes a hit.


@Jeffrey-Luszcz feel free to suggest a better example for the mixed-license scenario in the license section. You probably have a much stronger one than mine 🙏

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

github-actions · 2025-08-09T12:08:22Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

_articles/security-best-practices-for-your-project.md

xcorail

Nice additions!
I will let @Jeffrey-Luszcz weigh in on the licensing stuff, and I made a suggestion for the IR plan section, but I like the rest.

jmeridth · 2025-09-25T16:40:54Z

@UlisesGascon I see @xcorail has some suggestions above. Can you take a look and discuss/accomodate? I've pinged @Jeffrey-Luszcz and he'll be taking a look when he can. Thank you for the contribution.

_articles/security-best-practices-for-your-project.md

tomthorogood · 2025-09-26T16:51:48Z

_articles/security-best-practices-for-your-project.md

+
+Imagine this: You add a powerful library to your project, unaware that it uses a restrictive license. Later, a company wants to adopt your project but raises concerns about license compliance. The result? You lose adoption, need to refactor code, and your project's reputation takes a hit.
+
+To avoid these pitfalls, consider including automated license checks as part of your development workflow. These checks can help identify incompatible licenses early in the process, preventing problematic dependencies from being introduced into your project.


Is there an existing auto license check tool that we could link users to?

Not an expert on this, but we could point readers to a couple of options but not easy to adopt (IMO).

For example, FOSSA is a commercial tool that provides automated license-compliance scanning, and there’s also the OSS Review Toolkit (ORT), an open-source option that includes a license scanner: https://oss-review-toolkit.org/ort/docs/tools/scanner/

Most of the scanners I use personally are specific to npm universe 🤔.

@Jeffrey-Luszcz wdyt?

for npm? npmjs.com/licensee

Ref: github#3465 (comment)

_articles/security-best-practices-for-your-project.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

Ref: github#3465 (comment)

xcorail

LGTM for me - I just suggested a typo fix.
I will approve the PR, but I defer to @Jeffrey-Luszcz for the licensing part

Thanks @UlisesGascon for these additions!

_articles/security-best-practices-for-your-project.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

ahpook

Let's get this merged and deployed!

jmeridth · 2025-12-10T20:21:23Z

@ahpook iterate ftw. Thank you for merging.

preechapon250

Fixes #3465

UlisesGascon added 5 commits July 9, 2025 16:15

docs: mention license risks

becfcd3

docs: mention team effort

dc4df46

docs: mention threat models

c5ea56b

docs: mention IRP

272fa26

docs: minor changes

6b4e258

Copilot AI review requested due to automatic review settings July 9, 2025 14:28

UlisesGascon requested a review from a team as a code owner July 9, 2025 14:28

UlisesGascon temporarily deployed to Pages Preview July 9, 2025 14:28 — with GitHub Actions Inactive

UlisesGascon commented Jul 9, 2025

View reviewed changes

_articles/security-best-practices-for-your-project.md Show resolved Hide resolved

UlisesGascon temporarily deployed to Pages Preview July 9, 2025 14:29 — with GitHub Actions Inactive

UlisesGascon commented Jul 9, 2025

View reviewed changes

chore: linting

9e75f8c

UlisesGascon temporarily deployed to Pages Preview July 9, 2025 14:45 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview July 9, 2025 14:46 — with GitHub Actions Inactive

Copilot AI reviewed Jul 9, 2025

View reviewed changes

github-actions bot added the stale label Aug 9, 2025

Merge branch 'main' into update-seccurity

969353d

UlisesGascon temporarily deployed to Pages Preview August 9, 2025 12:40 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview August 9, 2025 12:41 — with GitHub Actions Inactive

github-actions bot removed the stale label Aug 10, 2025

Merge branch 'main' into update-seccurity

e886ee9

jmeridth temporarily deployed to Pages Preview August 12, 2025 14:17 — with GitHub Actions Inactive

jmeridth temporarily deployed to Pages Preview August 12, 2025 14:18 — with GitHub Actions Inactive

jmeridth requested a review from Jeffrey-Luszcz August 12, 2025 14:22

xcorail reviewed Sep 2, 2025

View reviewed changes

_articles/security-best-practices-for-your-project.md Outdated Show resolved Hide resolved

xcorail reviewed Sep 2, 2025

View reviewed changes

tomthorogood reviewed Sep 26, 2025

View reviewed changes

This comment has been minimized.

Sign in to view

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 15:04 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 15:05 — with GitHub Actions Inactive

chore: add link for better context

be54004

Ref: github#3465 (comment)

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 15:08 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 13, 2025 15:09 — with GitHub Actions Inactive

UlisesGascon marked this pull request as ready for review November 13, 2025 15:23

UlisesGascon requested a review from xcorail November 13, 2025 15:23

xcorail suggested changes Nov 13, 2025

View reviewed changes

_articles/security-best-practices-for-your-project.md Show resolved Hide resolved

_articles/security-best-practices-for-your-project.md Outdated Show resolved Hide resolved

_articles/security-best-practices-for-your-project.md Outdated Show resolved Hide resolved

Update _articles/security-best-practices-for-your-project.md

c4edccf

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:10 — with GitHub Actions Inactive

Update _articles/security-best-practices-for-your-project.md

0372fab

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:11 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:12 — with GitHub Actions Inactive

docs: add missing subtitle

c2a63a3

Ref: github#3465 (comment)

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:13 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 00:14 — with GitHub Actions Inactive

xcorail approved these changes Nov 14, 2025

View reviewed changes

_articles/security-best-practices-for-your-project.md Outdated Show resolved Hide resolved

Update _articles/security-best-practices-for-your-project.md

42523a4

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 08:51 — with GitHub Actions Inactive

UlisesGascon temporarily deployed to Pages Preview November 14, 2025 08:52 — with GitHub Actions Inactive

Merge branch 'main' into update-seccurity

3854e76

jmeridth temporarily deployed to Pages Preview November 18, 2025 17:20 — with GitHub Actions Inactive

jmeridth temporarily deployed to Pages Preview November 18, 2025 17:21 — with GitHub Actions Inactive

github deleted a comment from kwwbhsiwhw19 Dec 10, 2025

ahpook approved these changes Dec 10, 2025

View reviewed changes

ahpook added this pull request to the merge queue Dec 10, 2025

Merged via the queue into github:main with commit ee6e58b Dec 10, 2025
3 checks passed

preechapon250 reviewed Dec 24, 2025

View reviewed changes


		Using open source dependencies can speed up development, but each package includes a license that defines how it can be used, modified, or distributed. Some licenses are permissive, while others (like AGPL or SSPL) impose restrictions that may not be compatible with your project's goals or your users' needs.

		Imagine this: You add a powerful library to your project, unaware that it uses a restrictive license. Later, a company wants to adopt your project but raises concerns about license compliance. The result? You lose adoption, need to refactor code, and your project’s reputation takes a hit.


		Imagine this: You add a powerful library to your project, unaware that it uses a restrictive license. Later, a company wants to adopt your project but raises concerns about license compliance. The result? You lose adoption, need to refactor code, and your project's reputation takes a hit.

		To avoid these pitfalls, consider including automated license checks as part of your development workflow. These checks can help identify incompatible licenses early in the process, preventing problematic dependencies from being introduced into your project.

Conversation

UlisesGascon commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

UlisesGascon Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

khanimehdi117-rgb Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Aug 9, 2025

Uh oh!

Uh oh!

xcorail left a comment

Choose a reason for hiding this comment

Uh oh!

jmeridth commented Sep 25, 2025

Uh oh!

Uh oh!

tomthorogood Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

UlisesGascon Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

UlisesGascon Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

ljharb Nov 15, 2025

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

Uh oh!

Uh oh!

Uh oh!

xcorail left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ahpook left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jmeridth commented Dec 10, 2025

Uh oh!

preechapon250 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

UlisesGascon commented Jul 9, 2025 •

edited

Loading