License policy

License findings are alerts like any other. Socket detects the license on every package in the tree, and your license policy decides whether a violation blocks, warns, or is only recorded.

Before you start: a baseline for your repositories (Connect your repositories).

1. Set up the policy

1. In the dashboard, open Settings → Legal.
2. Run the quick setup. It applies default rules based on the Blue Oak tiers and common license families (permissive, weak copyleft, strong copyleft, network copyleft).
3. Adjust individual licenses your legal team has already ruled on.
4. Set the enforcement level. Warn comments on pull requests without failing the check, which suits most POCs. Switch to Block once the rules are agreed.

🚧

Licenses you haven't configured count as denied

The license policy is default-deny. Any license you haven't set, including license types Socket adds later, is treated as denied. If you want visibility on a license without denying it, set it to Monitor.

2. Check it against your baseline

Open Alerts and filter Category to License. This lists every package in your repositories that breaks the policy, with the repository it's in. It's the fastest way to see whether the rules match what legal expects, before any developer sees a comment.

3. See it in a pull request

Pick an npm package from the step 2 list. In socket-poc-sandbox, open a pull request that adds it to package.json, the same way as the pull request test. With silent mode off, the Socket comment names the license and the package it came from.

Verify

• License rules are saved under Settings → Legal
• Alerts filtered to License shows the expected violations, and nothing your legal team allows
• A pull request adding a disallowed license gets a Socket comment (Warn) or a failed check (Block)

Reference

• License Policy
• License alert types
• SBOM export for the license inventory procurement asks for