Check C6 · provenance family · severity MEDIUM · automatic · one of the 22 checks
The question this check asks: does this repository declare a licence GitHub can recognise? Not which one — whether anyone bothered.
The OpenSSF baseline asks for a real SPDX licence for the same reason it asks for recent commits and a recent release: a project meant to be used by strangers has to say on what terms. A repository with no licence is a legal risk to anyone who ships it and an obstacle to anyone auditing it — the vetting standard's word is that it "impedes audit". That is the ordinary reason, and it is the weaker one.
The stronger reason came out of our own measurement. Of the 100 surviving FakeGit repositories we scanned live, 50 had no licence. Of the 80 most popular repositories on GitHub, roughly one did. Nobody building a lure writes a licence, because the lure is not meant to be used; it is meant to be downloaded once. On any single repository the finding is a shrug. Across a campaign it is the most discriminating of the review-grade signals — and, after GitHub's takedowns removed the fresh-account cohort, the survivors were caught by this and by little else.
C6 reads the repository's license field. When it is empty the finding no-license fires at severity MEDIUM, costs 8 points, and reads “no license — legal risk and impedes audit”; a repository that trips nothing else scores 92, the badge stays green, the verdict is REVIEW, and the default personal policy warns — the download is held, the line is shown, proceeding is one click. When a licence is present it is recorded as an information line with its SPDX identifier at 0 points. It never blocks on its own. The evidence note in the scoring table:
“50% on campaign survivors vs ~1% top-100 — real aggregate discriminator”
Every personal project whose author never thought about it, every internal tool pushed public, every research artefact, every configuration-files repository. The absence is common and mostly innocent, which is why the weight is 8 and the action is a warning: the finding asks you to notice, not to leave. A licence GitHub cannot classify still counts as present — the field carries NOASSERTION rather than nothing — so an unusual or custom licence does not fire the check.
Anything about the code. A licence is a text file; an MIT file copied into a malicious repository is still an MIT file, and a present licence costs zero points precisely because presence proves nothing. The check does not read the licence's terms, does not compare them with the dependencies', and does not see a licence that lives somewhere GitHub's detection does not look. It is the OpenSSF baseline's third question, and the standard's verdict on the whole group applies: necessary, nowhere near sufficient.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: the licence, if GitHub recognised one, is in the sidebar of the repository page under About. With the GitHub CLI:
gh api repos/OWNER/REPO --jq '.license.spdx_id // "none"'Then, if it says none, ask the question the number is standing in for: was this repository ever meant to be used by anyone other than the person who put it up?
Does a missing licence mean the code is malicious? No. It means nobody wrote a licence — which is what a throwaway repository and a weekend project have in common. The finding is worth 8 points and warns because, in aggregate, half of the surviving FakeGit repositories had no licence against about one in a hundred of the most popular ones. On one repository it is a prompt; across a thousand it is a signal.
Does a licence make a repository safe? No. A licence is a text file, and an MIT file copied into a malicious repository is still an MIT file. RepoGates records the licence as an information line at zero points; the check only costs anything when the licence is absent.
Does RepoGates stop git clone? No. Browser-initiated downloads only.
C7 Maintenance activity — the other two questions of the OpenSSF baseline · C5 Contributor concentration — the second most common finding on campaign survivors · C1 Owner account age — the signal the survivors were built to pass.
Add RepoGates to Chrome Pricing
Numbers on this page: Phase 0 live tier of 2026-08-14 (100 surviving campaign repositories; 80 popular controls); the OpenSSF baseline as cited in the repository vetting standard; weights from the product's scoring table.