Open Source Licences Explained for People Building Apps

Almost every app today — especially one built by AI — is assembled from open-source code: frameworks, libraries, and tools that other people wrote and shared publicly. A typical web app depends on hundreds of these packages.

"Open source" doesn't mean "no rules," though. Each package comes with a licence that says what you're allowed to do with it. For most apps, the licences are relaxed and there's nothing to worry about. But a few licences come with real obligations, and it's worth knowing which.

This is general information, not legal advice. If your business depends on the answer, ask a lawyer.

What open source means

Open-source software is software whose source code is public, and whose licence lets you use, change, and share it. It's why you can build an app on React, PostgreSQL, and thousands of other tools without paying for them.

The licence is the author's terms. By using the code, you agree to them. Licences fall into two broad families.

Permissive licences: "do almost anything"

Permissive licences let you use the code for anything — including commercial, closed-source products — with very few conditions. Usually just: keep the copyright notice and the licence text with the code.

The common ones:

MIT — short, simple, very popular. React, Next.js, and a large share of npm packages use it.
Apache 2.0 — like MIT, with explicit terms about patents.
BSD (2- and 3-clause) — similar to MIT.
ISC — functionally similar to MIT; npm's default.

If everything your app uses is permissive, you're essentially free to build and sell it as you like. Most apps are in this situation.

Copyleft licences: "share alike"

Copyleft licences let you use and change the code, but if you distribute software that includes it, you must release your own code under the same licence. The idea is that improvements stay open.

GPL (GNU General Public License) — the classic copyleft licence. The key trigger is distribution: giving people a copy of the software, like a downloadable app. If your product includes GPL code and you distribute it, your code generally has to be released under the GPL too.
LGPL — a weaker version, often used for libraries: you can usually use the library without releasing your whole app, under certain conditions.
AGPL — the one to watch for web apps. It extends the GPL's trigger to running the software for users over a network. If you modify AGPL code and let people use it through your website, you may have to offer them your modified source code.

Why it matters: a web app's code usually never gets "distributed" — users just visit a website — so the GPL often doesn't bite. The AGPL was designed to close exactly that gap.

Other licences you'll see

"Source-available" licences (such as the Business Source License, Elastic License, and SSPL) — the code is public, but with restrictions, often against offering it as a competing hosted service. Not open source in the strict sense. Fine to use in many cases; read the terms.
No licence at all — code published without a licence isn't automatically free to use. Legally, all rights are reserved. Avoid it unless the author gives permission.
Creative Commons — mostly for content (images, text, fonts), not code.

Using tools vs including code

An important distinction: using a program is different from including its code in your app.

Running PostgreSQL as your database, or using a GPL-licensed tool on your computer to build your app, generally doesn't make your app's code subject to that licence. The obligations apply when the licensed code becomes part of what you ship (or, for AGPL, part of what you serve).

How to check your app's licences

For a JavaScript project, you can list the licences of everything installed:

npx license-checker --summary

This prints a count of each licence type in your dependencies. You're looking for anything that isn't permissive — especially GPL, AGPL, or UNKNOWN — and then checking what that package is and how you use it.

You can also ask your AI tool: "List every direct dependency in this project with its licence, and flag anything that isn't MIT, Apache, BSD, or ISC."

What about code the AI wrote?

AI tools generate code from patterns they learned, including from open-source projects. Occasionally they reproduce larger chunks of existing code closely. For typical app code, this is rarely a practical issue — but if an AI produces a large, distinctive block that looks copied (unusual comments, a specific author's name, a licence header), treat it with care and prefer a proper dependency instead.

If you publish your own code

If you make your project public on GitHub, add a licence, or others can't legally use it. Choose permissive (MIT) if you want maximum adoption, or copyleft (GPL/AGPL) if you want improvements to stay open. Sites like choosealicense.com explain the options.

The summary

Open source = public code you may use under the licence's terms.
Permissive (MIT, Apache, BSD, ISC): use freely, keep the notice. Most packages.
Copyleft (GPL): sharing your app may require sharing your code.
AGPL: watch this one for web apps — serving it over a network can trigger it.
No licence: not free to use.
Check with npx license-checker --summary before launching a commercial product.

EasySpawn runs Claude Code in a workspace with your full project and its dependencies installed — so you can ask it to audit licences, update packages, and explain what's in your app. See how it works or join the waitlist.