security
License Compliance Guard
Flags GPL, AGPL and other copyleft licenses before they force your source open.
What you get
Copyleft, caught early
ZipLoom reads the license of every dependency and flags GPL, AGPL and other copyleft terms before they can obligate you to open your own source.
The offending package, named
The specific package carrying the viral license is named, so you can replace it before it becomes a legal problem.
The transitive license nobody reads
A permissive top-level package can pull in a GPL or AGPL dependency several levels down — enough to put your commercial source at risk. The guard classifies every license in the tree and names the exact package and license, not just a count.
How license guard works
- 1
ZipLoom reads the license of each dependency in your tree.
- 2
Copyleft and viral licenses are flagged against your policy.
- 3
The offending package is named before the build ships.
What this check inspects
The license of every package in the tree, including transitive ones you never chose directly.
Copyleft licenses (GPL, AGPL, SSPL) that can impose obligations on the code you ship around them.
Packages with missing, ambiguous, or dual licenses, which are the ones that cause problems in diligence.
License changes between versions — a package can relicense on a minor bump.
What it means when this fails
An AGPL dependency deep in your tree can oblige you to publish the source of your commercial product, and this surfaces at the worst possible time: an acquisition, an enterprise security review, or a letter from the vendor. It is a legal exposure that no security scanner reports.
Questions
- Is this legal advice?
- No. It's a factual inventory of the licenses you're shipping and which ones carry obligations. Decisions about acceptable risk belong to you and your counsel.
- Why does a transitive license matter if I never chose it?
- Obligations follow the code you distribute, not the dependency you picked on purpose. If it ships in your bundle, its license applies.
- Can I allow a license the guard flags?
- Yes — record the decision once and it stays recorded, so the same package doesn't resurface as a new finding on every deploy.
What it replaces
Snyk Team
Per contributing developer, 5-seat minimum (~$1,500/yr entry). Code + dependency scanning; does not deploy your app.
GitHub Code Security
CodeQL scanning, Dependabot, dependency review. Billed per active committer; GitHub repos only.
Semgrep Team
SAST with a strong free OSS engine; rules and triage are yours to maintain.
ZipLoom Solo — all 28 features included
Deploy, security scan, and monitoring in one flat price. Guild $40/mo · Studio $70/mo · Business $299/mo.
Related features