Talk to us
Menu

Services · Audit

Open-source audit

A full list of the open-source code inside your software, with licence duties and security risks explained.

Modern software is mostly open-source packages, each with its own licence and its own vulnerabilities. Some licences require you to share source or include notices; some packages are abandoned or have known flaws. We scan every dependency, including transitive ones and copied-in code, produce a software bill of materials and explain what each finding means for how you ship and sell.

What you get

  • A software bill of materials in SPDX or CycloneDX format
  • A licence inventory flagging copyleft and conflicting licence terms
  • Known vulnerabilities in dependencies, checked for whether they are reachable
  • A list of abandoned or badly outdated packages with suggested replacements
  • The attribution notices your product must include, ready to publish
  • A policy and CI check that flags risky licences and packages in future changes

How it works

  1. 01

    Inventory

    We scan manifests, lock files, containers and source for every direct and transitive dependency.

  2. 02

    Analyse

    Licences are identified and checked for obligations and conflicts with how you distribute the software.

  3. 03

    Assess

    Vulnerabilities and package health are reviewed, and false positives removed by checking how code is used.

  4. 04

    Report

    You get the SBOM, findings and fixes, plus an automated check that keeps the picture current.

Scope it now.

Answer a few questions and we prepare the email for you. Nothing is sent until you press send in your own email app.

Prefer to write freely? hello@clockborn.com

Why do you need the audit?
How is the software delivered?
How many repositories?
Do you already generate an SBOM?

Questions

Is copyleft code a problem?

Not always. GPL obligations usually apply when you distribute software, and AGPL can apply when users reach it over a network. Whether they affect you depends on how you ship and link the code, which the audit explains case by case.

Is this legal advice?

No. We identify licences and explain their common obligations in technical terms. For decisions with legal weight, such as a licensing dispute or the sale of your company, your lawyers should confirm our findings.

Which ecosystems do you cover?

Common package managers such as npm, PyPI, Maven, NuGet, Go modules, Cargo, Composer and CocoaPods, plus container images. Code copied in without a package manager is checked by scanning files for licence headers and copyright notices.

Related services

Code reviewAn independent review of your codebase, with clear findings ranked by risk and a recommended fix for each.Technical due diligenceAn independent check of a company’s technology before you invest in it, buy it or depend on it.Compliance auditA readiness review against the data protection or security standard you must meet, with gaps and fixes listed.Penetration testingAuthorised testing of your applications and networks, under a signed scope, to find weaknesses before attackers do.

Software it applies to

Application securitySecurity checks built into the delivery pipeline, so flaws are caught in pull requests, not production.Vulnerability managementA single list of known weaknesses across your own systems, ranked by real risk and tracked until fixed.SDKs and client librariesTyped, documented client libraries that make your API easy to adopt in the languages your users write.

Language · 42