This section captures essential identification data for both the target software module and the open-source library under evaluation. Accurate metadata ensures traceability, supports audit requirements, and enables automated policy enforcement. All repository references must be immutable (commit hash or tag) to prevent evaluation drift.
Open-Source Library Name
Exact Library Version
Repository Source URL
Immutable Commit Hash or Tag
Package Manager or Distribution Channel
npm (Node.js)
Maven Central (Java)
PyPI (Python)
RubyGems (Ruby)
Go Modules
Cargo (Rust)
NuGet (.NET)
Direct Source Download
Operating System Package
Other
Target Software Module Name
Software Module Functional Description
Internal Project Code or Identifier
Current Development Phase
Architecture Design
Active Development
Code Review
Quality Assurance
Pre-Production Staging
Production Deployment
Legacy Maintenance
Primary Engineering Team
Technical Owner Email
Proposed Integration Date
Integration Scope and Environment
Frontend Client Application
Backend Server Application
Mobile App (iOS)
Mobile App (Android)
Embedded System Firmware
Build and CI/CD Pipeline
Testing and Mocking Framework
Internal Tooling
Documentation Generation
Database Migration Tool
License analysis determines the legal obligations triggered by library usage. Copyleft licenses may require source code disclosure, affecting proprietary IP. This review identifies compatibility with commercial licensing models and maps attribution, patent, and distribution requirements. Misclassification poses significant legal and financial risk.
Identified License Category
Permissive (MIT, Apache 2.0, BSD)
Weak Copyleft (LGPL, MPL, CDDL)
Strong Copyleft (GPL, AGPL)
Public Domain (Unlicense, CC0)
Proprietary/Commercial License
Multiple Licenses (Dual/Multi-licensing)
Custom/Non-Standard License
Unknown or Unlicensed
Explain LGPL static linking compliance strategy or dynamic linking implementation plan:
Justify GPL/AGGL usage and describe how copyleft obligations will be isolated or complied with:
Which license will be exercised for commercial use?
Commercial License Option
Open-Source License Option
Provide full custom license text and legal review summary:
Has legal counsel approved unlicensed code usage?
Upload legal approval memorandum
WARNING: Unlicensed code cannot proceed without explicit legal approval. This request will be rejected.
Full License Text as Found in Repository
Attach LICENSE File from Repository
Does this library offer a commercial dual-license option?
Commercial License Cost and Vendor Contact
Identified Legal Obligations (select all that apply)
Attribution Notice in Documentation
Source Code Availability upon Distribution
Copyleft Inheritance (Derivative Works)
Patent Grant and Defense Clause
Trademark Usage Restrictions
Same License Redistribution
No Warranty Acknowledgment
Export Control Disclaimer
License Compatibility with Commercial Product Licensing Model
Highly Incompatible
Incompatible
Neutral
Compatible
Fully Compatible
Will this library be modified or distributed outside the organization?
Detail modification scope and distribution channel:
License Compatibility Matrix with Company Products
Product Name | Product License Type | Compatible? | Compatibility Justification or Restrictions | ||
|---|---|---|---|---|---|
A | B | C | D | ||
1 | |||||
2 | |||||
3 | |||||
4 | |||||
5 | |||||
6 | |||||
7 | |||||
8 | |||||
9 | |||||
10 |
Security scanning identifies known vulnerabilities (CVEs) and supply chain risks. Transitive dependencies multiply attack surfaces. This assessment validates that the library meets organizational security baselines and defines remediation timelines. Unmaintained libraries or critical CVEs may constitute an automatic rejection.
Has automated vulnerability scanning been completed using approved tools?
Scanning Tool Used
Snyk
OWASP Dependency-Check
WhiteSource/Mend
Black Duck
Sonatype Nexus Lifecycle
GitHub Dependabot
GitLab Security Scanner
Manual CVE Database Review
Describe manual review methodology and CVE sources:
CRITICAL: Scanning must be completed before submission. Please abort and run required security scans.
Upload Complete Vulnerability Scan Report
Vulnerability and Risk Tracking Register
CVE Identifier | Severity (CVSS Score) | Vulnerability Description | Is library affected? | Patched Version Available | Exploitability (1=Low, 5=Critical) | Mitigation Actions Taken | ||
|---|---|---|---|---|---|---|---|---|
A | B | C | D | E | F | G | ||
1 | CVE-2023-12345 | 7.5 | Prototype pollution in merge function | Yes | 4.17.21 | Updated to patched version | ||
2 | CVE-2022-99999 | 9.8 | Remote code execution | N/A | Not affected; functionality not used | |||
3 | ||||||||
4 | ||||||||
5 | ||||||||
6 | ||||||||
7 | ||||||||
8 | ||||||||
9 | ||||||||
10 |
Overall Security Risk Score (1=Minimal, 10=Critical)
Have all transitive (indirect) dependencies been analyzed?
CRITICAL: Full dependency tree analysis is mandatory. Please complete analysis of all nested dependencies.
Identified Supply Chain Risk Factors
No active maintainer in past 12 months
Single maintainer (bus factor risk)
Typosquatting or namespace confusion potential
Recent repository takeover incident
Cryptocurrency mining code discovered
Obfuscated or minified source code
No signed releases or tags
Known malicious version in ecosystem
Security Mitigation and Monitoring Plan
Does the library have a published security policy and disclosure process?
Date of Last Security Update or Patch Review
This section evaluates the risk of proprietary IP contamination. Copyleft licenses can infect proprietary code if not properly isolated. Static linking creates derivative works; dynamic linking offers better separation. Architecture decisions directly impact IP ownership and competitive advantage protection.
Library Integration Method
Static Linking (compiled into binary)
Dynamic Linking (shared library/.dll/.so)
Runtime Dependency (interpreted at runtime)
Build Tool or Code Generator only
Documentation/Example Code only
Network Service/API Call (SaaS separation)
Justify static linking given copyleft contamination risk and describe how resulting binary will be distributed:
NOTE: Network separation (SaaS) may mitigate AGPL obligations but does not eliminate all copyleft risks for internal modifications.
Will any modifications be made to the library source code?
Detail modifications, business justification, and how changes will be documented and potentially disclosed:
Has an API abstraction layer or wrapper been implemented to isolate library usage?
Upload wrapper interface design document
RECOMMENDATION: Implementing an abstraction layer reduces coupling and facilitates library replacement if license issues arise.
IP Risk Factor Assessment
No Risk | Low Risk | Medium Risk | High Risk | Critical Risk | |
|---|---|---|---|---|---|
Proprietary algorithms exposed through library integration | |||||
Library will be embedded in core product differentiator | |||||
Reverse engineering would reveal business logic | |||||
No alternative proprietary library available | |||||
Library touches customer data encryption/handling |
Applied Risk Mitigation Strategies
Separate compilation unit or module
Process isolation (separate microservice)
Container/VM isolation
Network boundary separation
API gateway mediation
Code obfuscation applied
No mitigation applied
Does this library contain any code contributed by non-employees (external contributors)?
Describe contributor license agreement (CLA) status and IP assignment verification:
Has export control classification review been completed?
Complete export control review before submission. Encryption libraries especially require classification.
Upload Architecture Diagram Showing Library Boundary
IP Risk Justification and Business Necessity
Final approval requires both technical and legal authority acknowledgment of risks and obligations. Conditional approvals may impose restrictions on usage, distribution, or require commercial license procurement. This clearance is time-bound and subject to re-evaluation upon library updates or product release changes.
Chief Technology Officer (CTO) Approval - Do you approve this library integration?
Approval Type
Unconditional Approval
Conditional Approval - Monitor
Conditional Approval - Restrict Usage
Conditional Approval - Require Commercial License
Define monitoring conditions and reporting requirements:
Define usage restrictions (e.g., internal only, non-customer-facing):
Commercial License Procurement Deadline
Provide rejection rationale and recommend alternative approaches:
CTO Technical Risk Assessment and Justification
Chief Technology Officer Digital Signature
CTO Approval Timestamp
Lead IP Counsel Approval - Do you approve this library integration from an intellectual property perspective?
Legal Risk Classification
Low Risk - Standard Approval
Medium Risk - Approval with Noted Exceptions
High Risk - Approval with Strict Conditions
Critical Risk - Approval Reserved for Executive Override Only
Detail noted legal exceptions and qualifications:
Define strict legal conditions and compliance verification requirements:
Document executive override justification and residual risk acceptance:
Provide legal rejection rationale and IP risk analysis:
IP Counsel Legal Review Summary
Lead IP Counsel Digital Signature
IP Counsel Approval Timestamp
Overall Risk Acceptance Level
Low Risk - Standard Monitoring
Medium Risk - Enhanced Monitoring
High Risk - Quarterly Review Required
Critical Risk - Monthly Executive Review
Clearance Expiration Date (maximum 12 months)
Is an audit trail and usage tracking mechanism required for this library?
Define audit frequency, data collection requirements, and reporting recipients:
APPROVAL CONDITIONS: This clearance is valid only for the specified library version and integration context. Any version changes, modifications, or scope expansions require re-evaluation. The technical owner must monitor security advisories and license changes. Failure to comply with stated obligations may result in product distribution cessation and legal liability.
To configure an element, select it on the form.