PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Using FOSSA for License Compliance

hackerone.com | blog | #open-source | #legal | #due-diligence | #dependencies | #license-compliance | #fossa
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How to use FOSSA to audit open-source license compliance before fundraising or exit diligence: scan your dependencies and generate a report flagging incompatible licenses before they derail a deal.
Published
Collected

Related coverage

blog · netspi.com
Open Source Software – Is It the Death of Your Company?
Warns that companies often don't know which open source components their applications contain, covering license risks from permissive to copyleft and the security vulnerabilities buried in OSS.
blog · hackerone.com
A Partial Victory for AI Researchers
A recent DMCA Section 1201 ruling lowers legal risk for independent AI researchers who bypass technical protection measures, but falls short of the safeguards HackerOne sought for AI safety research.
blog · hackerone.com
Takeaways from the Dismissal of Most of the Government’s Case Against the SolarWinds CISO
A New York court dismissed most of the SEC's case against SolarWinds and its CISO, ruling the SEC lacks authority to regulate cyber resilience, while one disclosure claim proceeds to trial.
blog · hackerone.com
Why is NPM Fetching a Dependency Not in My package-lock.json?
npm can fetch dependencies missing from package-lock.json when packages come from GitHub repos, relative paths, or carry peer dependencies; the post explains why and how to manage it safely.
blog · hackerone.com
CISOs: Do You Know the Security Risks of Your Organization's Next M&A?
HackerOne CISO Chris Evans argues M&A due diligence often misses inherited security risk: survey data shows organizations defend only 63% of their attack surface, so acquisitions can import a 37% gap.
blog · hackerone.com
Avoiding the Hazards of Dependencies - Part 2
Mobile developer Chris Griffith shares practices for mitigating third-party dependency risks, including abstraction layers that ease library removal, with Swift examples applicable across platforms.
Back