security
License Compliance Guard
Blocks AGPL, SSPL And Restricted Licenses Before They Ship. Flags GPL And Other Copyleft.
What you get
The Risky Ones Stop The Deploy
A production dependency under a network-copyleft license (AGPL, SSPL) or a restricted-use license (Business Source, Commons Clause) blocks the deploy — because serving it over a network can oblige you to publish your source or pay for commercial rights. GPL and weak copyleft (LGPL, MPL) are reported without blocking. Dev-only dependencies never block.
The Offending Package, Named
The specific package carrying the viral license is named, so you can replace it before it becomes a legal problem.
The Transitive License Nobody Reads
A permissive top-level package can pull in a GPL or AGPL dependency several levels down — enough to put your commercial source at risk. The guard classifies every license in the tree and names the exact package and license, not just a count.
How License Guard Works
- 1
ZipLoom resolves the published license of each exact package version your lockfile installs, transitive included.
- 2
AGPL, SSPL and restricted-use licenses in production dependencies block the deploy; GPL and weak copyleft are reported.
- 3
The offending package is named. If your use is compliant, an Owner or Admin accepts it once in Security → Findings and deploys continue — a license change on that package needs a fresh acceptance.
What this check inspects
The license of every package in the tree, including transitive ones you never chose directly.
Copyleft licenses (GPL, AGPL, SSPL) that can impose obligations on the code you ship around them.
Packages with missing, ambiguous, or dual licenses, which are the ones that cause problems in diligence.
License changes between versions — a package can relicense on a minor bump.
What it means when this fails
An AGPL dependency deep in your tree can oblige you to publish the source of your commercial product, and this surfaces at the worst possible time: an acquisition, an enterprise security review, or a letter from the vendor. It is a legal exposure that no security scanner reports.
Questions
- Is this legal advice?
- No. It's a factual inventory of the licenses you're shipping and which ones carry obligations. Decisions about acceptable risk belong to you and your counsel.
- Why does a transitive license matter if I never chose it?
- Obligations follow the code you distribute, not the dependency you picked on purpose. If it ships in your bundle, its license applies.
- Can I allow a license the guard blocks?
- Yes. An Owner or Admin accepts that package once in Security → Findings, the decision is written to your tamper-evident audit log, and deploys continue. If the package later changes its license, it needs a fresh acceptance.
What it replaces
Snyk Team
Per contributing developer, 5-seat minimum (~$1,500/yr entry). Code + dependency scanning; does not deploy your app.
GitHub Code Security
CodeQL scanning, Dependabot, dependency review. Billed per active committer; GitHub repos only.
Semgrep Team
SAST with a strong free OSS engine; rules and triage are yours to maintain.
ZipLoom Solo — every deploy check included
Deploy, security scan, and monitoring in one flat price. Guild $40/mo · Studio $70/mo · LoomWorks $149/mo · Business $299/mo.
Related features