Skip to main content

Review license findings

Open License compliance when you need to see which licenses and components conflict with your organization's license policy, either across the organization or for one project.

License data comes from each SBOM's component inventory. RunSafe-generated language SBOMs include that license data when the SBOM is created; Non-SPDX labels still appear in compliance views when they conflict with policy.

Review the organization roll-up​

  1. Open License compliance in the organization sidebar.
  2. Use the summary cards for violation counts, how licenses break down against policy (allowed, denied, or mixed when project overrides disagree), and whether organization license enforcement is active.
  3. Use the licenses table to see each license's policy status, how many projects use it, occurrence and component counts, and first and last seen times.
  4. Select a license name to open a detail page with policy context, metrics, and the component findings for that license.
  5. On the detail page, use Edit policy to jump to Settings → License Compliance.

Organization-level findings use:

  • The latest complete default-branch Build for each enabled SCM-backed project
  • The latest complete uploaded SBOM for each enabled Generic project
  • Complete organization-level manual uploads that are not tied to a project

Review one project​

  1. Open the project and then License compliance.
  2. For SCM-backed projects, this page summarizes the latest complete Build on the default branch. Open Builds when you need license findings for another Build.
  3. Use File path to locate the component in source when the finding comes from an SCM-backed Build, or to read an image reference for Docker SBOMs. Generic project uploads show File path as text because the upload is not tied to a scanned git ref for a blob link.

Project findings use:

  • SCM-backed views summarize the latest complete default-branch Build.
  • Generic projects use the latest uploaded SBOM data.

Findings reflect the effective policy for that project: the organization default, or a project override when one is active.

Change the policy these findings use​

Organization defaults live under Settings → License Compliance. To use different rules per project, open that project's Settings → License Compliance page.

See Set license policy for the override steps.