Public ≠ permission
Even a repository published on GitHub is not open source if it has no LICENSE file. Copyright arises automatically the moment code is written (in most Berne Convention countries), and without separate permission only the copyright holder may copy, modify, distribute or create derivative works. GitHub's documentation also explains that without a license, default copyright law applies, the copyright holder retains all rights, and nobody else may reproduce, distribute or create derivative works.
What GitHub's terms allow
Under GitHub's Terms of Service (D.5, "License Grant to Other Users"), anyone who posts content in a public repository grants GitHub users the right to use, display and perform that content through the GitHub service, and to reproduce it only as permitted by GitHub's functionality, such as forking. So the following is allowed:
- Viewing and reading the code on the web
- Forking it within GitHub
However, the terms do not grant rights beyond this, such as including it in your product and distributing it, or publishing a modified version elsewhere.
If you want to use unlicensed code
- Ask the copyright holder: Request a license via an issue or email. In many cases they simply forgot and will gladly add MIT or similar.
- Get written permission: If adding a license is difficult, obtain and keep a separate permission stating the scope of use.
- Find an alternative: Look for an open source library with the same functionality.
- Implement it yourself: Write new code based only on the specification or behavior without looking at the code (a so-called clean-room implementation). Be careful: transcribing the original code may count as copying.
A README that only says "use it however you like" is ambiguous. The intent may seem clear, but the scope (modification, redistribution, commercial use) is unclear, so it is safer to ask for a standard license to be added.
Common ambiguous cases
- No LICENSE, but
"license": "MIT"in package.json: The intent appears to be MIT, but MIT requires the copyright notice and permission notice to be included in copies, so without the full text it is hard to comply with the notice requirement. It is better to ask for a LICENSE file to be added to the repository. - Code from Stack Overflow answers: User-contributed content is provided under Creative Commons BY-SA (2.5, 3.0 or 4.0 depending on when it was posted). It has attribution and ShareAlike conditions, so check your company policy before copying it into product code.
- Code from blogs and tutorials: Unless the site's terms of use or the post says otherwise, copyright is reserved by default.
How to add a license to your repository
- Choose a license in the generator, enter the year and copyright holder, and download the
LICENSEfile. - Commit it to the root of the repository. GitHub detects this file and shows the license in the repository information.
- Put the SPDX identifier in the license field of
package.json,Cargo.toml,pyproject.tomland similar files (SPDX guide). - If other people's code is mixed in, sort out the licenses and notices for those parts separately (applying a license).
Deliberately not adding a license
If you only want to show your code, such as a portfolio or coursework, and do not want it reused, not adding a license is also a choice. In that case, writing "All rights reserved" and your contact details in the README reduces misunderstandings. However, as long as the repository is public, you cannot prevent the viewing and forking that GitHub's terms allow.
This article is general information, not legal advice. Consult a professional for important decisions.
Sources
- GitHub Docs, Licensing a repository — https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository
- GitHub Terms of Service, D.5 — https://docs.github.com/en/site-policy/github-terms/github-terms-of-service
- choosealicense.com, No License — https://choosealicense.com/no-permission/
- Stack Overflow content licensing — https://stackoverflow.com/help/licensing