---
metadata:
  - name: generator
    content: Diplodoc Platform v5.57.3
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/license-policy.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/operations/license-policy.md
  - href: en/sourcecraft/operations/license-policy.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
title: How to configure a license policy as code in SourceCraft
description: Follow this guide to define a license policy for dependencies in a SourceCraft repository using the licenses.yaml configuration file.
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt


# Configuring a license policy as code in SourceCraft

In SourceCraft, the dependency license management policy can be coded (Policy as Code) using the `.sourcecraft/security/licenses.yaml` configuration file. The platform automatically checks the licenses of all repository dependencies and flags those with risk level exceeding the allowed threshold. For more on vulnerability analysis, see [Analyzing vulnerabilities in SourceCraft repository dependencies](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/supply-chain.md).

[Example of a SourceCraft repository with a license policy](https://sourcecraft.dev/examples/appsec-licenses)

To configure a license policy as code:
1. [Enable](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/scanning-switch.md) dependency vulnerability analysis in the repository.
1. [Create](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/add-file-repo.md) a file named `.sourcecraft/security/licenses.yaml` with the following contents in the repository:

    ```yaml
    version: 0.0.1
    licenses:
      MIT:
        risk: 0
      ISC:
        risk: 5
      BSD-3-Clause:
        risk: 10
    ```

    Where:
    * `version`: Configuration schema version. Current version: `0.0.1`.
    * `licenses`: Dictionary of licenses and their risk levels.
    * `risk`: Integer value representing the risk level from `0` to `10`.
      * `0`-`2`: License is completely acceptable.
      * `3`-`6`: License requires attention.
      * `7`-`9`: License is undesirable.
      * `10`: License is prohibited.

    {% note tip %}

    In addition to a repository-level license policy, you can configure a policy for an organization. Proceed as follows:
    1. [Create](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/repo-create.md) a dedicated repository named `.sourcecraft` in your organization.
    1. In a similar way, add the `.sourcecraft/security/licenses.yaml` file with the policy description to the repository.

    When analyzing vulnerabilities, the policy configured for the target repository takes priority. If no `.sourcecraft/security/licenses.yaml` file exists in the target repository, the policy from the `.sourcecraft` repository applies. If there is no such policy either, the default SourceCraft global configuration is used.

    {% endnote %}

1. To save your changes:

    <!-- source: en/_includes/sourcecraft/commit-message.md -->
    1. In the top-right corner, click **Commit changes**.
    1. In the window that opens, configure the procedure for changes:

        <!-- source: en/_includes/sourcecraft/commit-message-settings.md -->
        * In the **Commit message** field, give a comment that will describe the changes you make.
        * Under **Commit branch**, select the branch you want to change. Create a new branch as needed.
        * Under **After commit action**, select an action to take after saving changes: `Save and create a new change proposal` or `Just save`.
        <!-- endsource: en/_includes/sourcecraft/commit-message-settings.md -->

    1. Confirm your changes.
    <!-- endsource: en/_includes/sourcecraft/commit-message.md -->

## Test the policy {#how-it-works}

You can test dependency license policies as follows:
1. On each commit to the default branch, SourceCraft scans the repository for vulnerabilities.
1. For each vulnerability, SourceCraft detects its license.
1. The license is evaluated against the configuration in the following order: target repository policy → `.sourcecraft` repository policy → SourceCraft global policy.
1. If the license’s risk level exceeds the allowed threshold, the dependency is flagged in the ![image](../../_assets/console-icons/shield-exclamation.svg) **Security** section of the repository or organization on the ![image](../../_assets/console-icons/box.svg) **Packages** and ![image](../../_assets/console-icons/nodes-left.svg) **Dependency map** tabs. 

For more information, see [Analyzing vulnerabilities in SourceCraft repository dependencies](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/supply-chain.md).

### Useful links {#see-also}

* [appsec-licenses repository in SourceCraft](https://sourcecraft.dev/examples/appsec-licenses)
* [Security in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/security-overview.md)
* [Analyzing vulnerabilities in SourceCraft repository dependencies](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/supply-chain.md)
* [Security dashboard in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/security-dashboard.md)
* [Enabling and disabling security scanning in a SourceCraft repository](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/scanning-switch.md)