Open Source Licenses for Developers and Vibe Coders: Answers to the Questions You Actually Ask

Your project today probably holds hundreds of packages from npm install or pip install, a few snippets from Stack Overflow, and half its functions written by Cursor, Copilot or Claude. It all runs. The question only shows up when you want to sell the product, open the repo, or an investor starts due diligence: are you actually allowed to use all this code the way you are using it?

This article answers the questions developers and vibe coders really ask in forums, GitHub issues and community chats, rather than walking through each license clause by clause. Every section opens with the short answer, then the reasoning.

Important: this is a technical explainer for engineers, not legal advice. For contracts, acquisitions or disputes, talk to a lawyer who knows intellectual property.

The short map: five families of licenses

Almost every license you meet belongs to one of these families. The column that matters most is what triggers the obligations.

Family	Examples	Main obligation	Triggered when
Permissive	MIT, BSD-2/3-Clause, ISC, Apache-2.0	Keep the license text and copyright notice. Apache-2.0 adds a NOTICE file, change notes and a patent license.	You distribute the code
Weak copyleft	LGPL-2.1/3.0, MPL-2.0	Changes to the library (LGPL) or the file (MPL) itself must be shared. Your own code can stay closed.	Distribution
Strong copyleft	GPL-2.0, GPL-3.0	Derivative works you distribute must be released under the GPL too.	Distribution
Network copyleft	AGPL-3.0	Like the GPL, plus: users who interact with a modified version over a network are entitled to its source.	Distribution or serving a modified version over a network
Source-available (not open source)	BSL 1.1, SSPL, Elastic License, many AI model licenses	You can read the code, but some uses are forbidden, usually competing services or use above a certain scale.	Depends on the license text

One more category people forget: no license at all. That does not mean free. More on that below.

What is an open source license, really?

By default, code you write is protected by copyright, and nobody else may copy, modify or distribute it. A license is written permission from the copyright holder that opens up some of those rights, on conditions.

A license counts as open source when it meets the Open Source Initiative's (OSI) Open Source Definition: it allows use for any purpose, commercial use included, allows modification and redistribution, and does not discriminate against people or fields of endeavour. That is why a license that forbids commercial use or caps the number of users is not open source under the OSI definition, however visible the code is.

The practical consequence: break a license's conditions and the permission ends, and your use becomes ordinary copyright infringement. GPL-3.0 offers a way back: if it is your first violation and you fix it within 30 days of being notified, your license is reinstated.

Can I use code from a GitHub repo that has no LICENSE file?

No. A public repo with no license is "all rights reserved". GitHub's terms let people view and fork public repos on GitHub, but they do not grant permission to use, modify or distribute the code in your project.

What you can do:

• Open an issue asking the owner to add a license. Often they simply forgot.
• Write your own implementation from your understanding of the idea. Ideas and algorithms are not protected by copyright; the expression in the code is.
• Do not paste that code into an AI prompt and treat the result as clean. If the output matches line for line, the problem is the same.

Can I use MIT or Apache-2.0 libraries in a paid, closed-source app?

Yes. That is what permissive licenses are for. You may sell the product and you do not have to open your code. The one condition people skip: the license text and copyright notice must travel with every copy you distribute.

Where those "copies" appear without you noticing:

• JavaScript bundles in the browser. Library code that is bundled and minified is still a copy shipped to users. Keep license comments (/*! ... */) when minifying, or generate a third-party notices file at build time and link it from the app.
• Mobile and desktop apps. That "Open source licenses" screen in the settings menu is not decoration; it is license compliance.
• Docker images you hand to customers. An image given to someone else is a distribution.

Tools such as license-checker or rollup-plugin-license for JavaScript and pip-licenses for Python can build that list for you.

MIT or Apache-2.0 for my own project?

The main difference is patents. Apache-2.0 grants an explicit patent license from every contributor to users, and that license ends for anyone who sues over patents in the project. MIT is short and simple but says nothing about patents.

Choose	When
MIT	Small projects, utilities, templates, or you want a license anyone can read in a minute.
Apache-2.0	Larger or company-backed projects, or patent-heavy fields such as AI, cryptography and networking.
MIT OR Apache-2.0	The dual license common in the Rust ecosystem: users pick one, including one that works with GPL-2.0 (Apache-2.0 is not compatible with GPL-2.0).
GPL-3.0 or AGPL-3.0	You want every derivative to stay open, and accept the trade-off: many companies avoid copyleft dependencies.

Whatever you choose, put a LICENSE file at the root of the repo and declare its SPDX identifier (for example "license": "MIT" in package.json) so scanners can read it.

Can I use a GPL library in a closed-source SaaS?

For code that only runs on your servers, generally yes. GPL obligations are triggered by distribution. Users who use your app through a browser do not receive a copy of the server program, so nothing is distributed. This gap is often called the SaaS loophole.

There are three traps:

• Frontend code. JavaScript sent to users' browsers is distributed. A GPL library in your frontend bundle pulls GPL obligations onto the code combined with it.
• Self-hosted or on-premise editions. As soon as a customer receives the software to run themselves, that is distribution.
• The AGPL. The AGPL exists precisely to close the SaaS loophole. See the next section.

The LGPL is looser: you may use an LGPL library from closed code as long as users can still swap the library, in practice through dynamic linking, and changes to the library itself are shared. MPL-2.0 works per file: MPL files you change must be shared, your own files need not be.

AGPL: when do I have to release my code?

If you modify an AGPL program and other people use it over a network, you must offer those users the source of your modified version. That is section 13 of AGPL-3.0.

• Using it unmodified (say, running an AGPL database as-is behind your app): section 13 is not triggered. Your app, which only talks to it over the network, is generally not affected.
• Internal tools used only by employees: generally not triggered. Watch for contractors, test accounts shared with clients and public links; once outsiders use a modified version, the obligation applies.
• A SaaS product built on AGPL code you modified: the obligation covers that whole derivative work.

Because the line moves easily as a product grows, many companies keep a simple rule: no AGPL dependencies inside product code without sign-off.

Are the BSL and SSPL open source?

No. Licenses such as the Business Source License (BSL) and the Server Side Public License (SSPL) are source-available: you can read the code and usually use it, but with restrictions, most often against offering the software as a competing service. The BSL also has a change date: after a few years, each version converts to the open source license named in it.

This matters because projects you depend on can change license:

• HashiCorp (2023): Terraform, Vault and others moved from MPL-2.0 to BSL 1.1. The community forked them as open source: OpenTofu and OpenBao.
• Redis (2024–2025): moved to a source-available license and the SSPL in 2024, then added AGPL-3.0 as an option from Redis 8. The Valkey fork stays BSD.
• Elastic (2021–2024): moved to the SSPL and Elastic License in 2021, then added AGPL-3.0 in 2024. The OpenSearch fork stays Apache-2.0.

The lesson: a license is attached to a version. Versions already released under an open source license stay open source. Pin your dependency versions and read the license when you take a major upgrade.

Who owns code written by Cursor, Copilot or Claude?

Under those tools' terms, the output is yours. Whether that output is protected by copyright is a separate question.

• Vendor terms: GitHub does not claim ownership of Copilot suggestions, and Cursor says generated code belongs to the user. A vendor can only hand over rights that exist.
• Copyright: Part 2 of the U.S. Copyright Office's report on AI (29 January 2025) concluded that prompts alone, however detailed, do not make you the author of AI output. What can be protected is the human contribution: code you write yourself, substantial changes to AI output, and the selection and arrangement of the pieces. It is decided case by case. Other countries can differ; the UK, for one, has a specific rule for computer-generated works.
• What it means for vibe coders: a repo generated almost entirely from prompts may have thin copyright protection, so a competitor who copies it is harder to pursue. Review, restructure and change AI-generated code; it is safer legally and it is better code.

Can I put an MIT license on AI-written code? Yes. The license covers the parts you own; parts that are not protected by copyright are free for anyone to use anyway.

Can AI-written code bring a GPL license into my project?

It can, though rarely. Models are trained on public code under many licenses, and GitHub itself acknowledges that Copilot occasionally reproduces code from its training data verbatim. If that snippet comes from a GPL project and is long enough to be protected, its license comes with it.

• Turn on the filter that blocks suggestions matching public code if your tool offers one (Copilot has this setting).
• Be suspicious of long blocks that arrive whole, especially with distinctive comments, variable names or another project's copyright header.
• Run license and code-similarity scanning in CI if your product is commercial or heading toward an acquisition.
• Check IP indemnity: some business plans of AI coding tools include it, others do not. Read your plan's terms.

Is Llama open source? AI model licenses are not code licenses

Llama is an open weight model, not open source under the OSI definition. You can download the weights and use them commercially, but the Llama Community License has conditions no open source license has:

• Companies with more than 700 million monthly active users must request a separate license from Meta.
• You must show "Built with Llama" attribution and follow the acceptable use policy.
• The rule on using Llama outputs to train other models has changed between versions: Llama 2 forbade it for other large language models, later versions allow it with a naming requirement. Read the license of the version you use.

The OSI published the Open Source AI Definition 1.0 in October 2024. Under it, an open source AI model must come with its weights, its training and inference code, and enough information about its training data. Apache-2.0 weights without the code and data information are better described as permissively licensed open weights.

When you download a model from Hugging Face or any marketplace, check three things:

1. The weights' license on the model card: Apache-2.0 and MIT are fine for commercial use; CC BY-NC and "research only" licenses are not; OpenRAIL allows commercial use but carries a list of use restrictions you must pass on to your users.
2. The base model's license. A fine-tuned model is still bound by its base model's license. A fine-tune of Llama is still under the Llama license.
3. The license of the exact checkpoint. Different sizes in the same model family can carry different licenses.

On the Intura marketplace, every model page names its base model, for example DistilBERT, so you can trace its license. The intura-ai Python SDK itself is MIT-licensed.

Can I copy code from Stack Overflow?

Yes, with attribution. Stack Overflow content is licensed under Creative Commons BY-SA (the version depends on when it was posted). Link the original answer in a code comment. The ShareAlike clause requires derivative works to use a compatible license, which is why some companies forbid copying long snippets from there.

The "under 10 lines is always fine" rule is a myth; copyright law has no line count. Truly trivial snippets that can only be written one way are generally not protected, but that is judged case by case.

Can I change my project's license later?

For code that is entirely yours: yes, any time, but only for future versions. Anyone who already received an older version under the old license keeps that permission.

Once other people contribute, each contributor holds the copyright in their contribution. Relicensing then needs every contributor's permission, unless they signed a Contributor License Agreement (CLA) that gives you the right to relicense. If you cannot reach a contributor, the option left is rewriting their part. So decide the license early, and consider a CLA or the Developer Certificate of Origin (DCO) once your project starts taking contributions.

A checklist before you ship

1. Your repo has a LICENSE file and an SPDX identifier in the package manifest.
2. A license list of every dependency is generated automatically and checked in CI. Flag GPL, AGPL, SSPL, BSL and "no license" for manual review.
3. No GPL library sits in your frontend bundle or in apps you ship to customers, unless your product is GPL.
4. No AGPL code you modified runs in a product outsiders use, unless you are ready to release it.
5. A third-party notices file ships with frontend builds, mobile apps and Docker images.
6. Every AI model and dataset license has been checked, including the base model's license and any limits on commercial use.
7. AI-written code is reviewed, the public-code matching filter is on, and suspicious blocks are rewritten.
8. Stack Overflow snippets are attributed with a link to the original answer.

Licensing is not an end-of-project task. Ten minutes checking a license when you pick a dependency is far cheaper than rewriting a module the week before launch.