This section captures essential identification data for both the target software module and the open-source library under evaluation. Accurate metadata ensures traceability, supports audit requirements, and enables automated policy enforcement. All repository references must be immutable (commit hash or tag) to prevent evaluation drift.
Open-Source Library Name
Exact Library Version
Repository Source URL
Immutable Commit Hash or Tag
Package Manager or Distribution Channel
npm (Node.js)
Maven Central (Java)
PyPI (Python)
RubyGems (Ruby)
Go Modules
Cargo (Rust)
NuGet (.NET)
Direct Source Download
Operating System Package
Other
Target Software Module Name
Software Module Functional Description
Internal Project Code or Identifier
Current Development Phase
Architecture Design
Active Development
Code Review
Quality Assurance
Pre-Production Staging
Production Deployment
Legacy Maintenance
Primary Engineering Team
Technical Owner Email
Proposed Integration Date
Integration Scope and Environment
Frontend Client Application
Backend Server Application
Mobile App (iOS)
Mobile App (Android)
Embedded System Firmware
Build and CI/CD Pipeline
Testing and Mocking Framework
Internal Tooling
Documentation Generation
Database Migration Tool
License analysis determines the legal obligations triggered by library usage. Copyleft licenses may require source code disclosure, affecting proprietary IP. This review identifies compatibility with commercial licensing models and maps attribution, patent, and distribution requirements. Misclassification poses significant legal and financial risk.
Identified License Category
Permissive (MIT, Apache 2.0, BSD)
Weak Copyleft (LGPL, MPL, CDDL)
Strong Copyleft (GPL, AGPL)
Public Domain (Unlicense, CC0)
Proprietary/Commercial License
Multiple Licenses (Dual/Multi-licensing)
Custom/Non-Standard License
Unknown or Unlicensed
Full License Text as Found in Repository
Attach LICENSE File from Repository
Does this library offer a commercial dual-license option?
Identified Legal Obligations (select all that apply)
Attribution Notice in Documentation
Source Code Availability upon Distribution
Copyleft Inheritance (Derivative Works)
Patent Grant and Defense Clause
Trademark Usage Restrictions
Same License Redistribution
No Warranty Acknowledgment
Export Control Disclaimer
License Compatibility with Commercial Product Licensing Model
Highly Incompatible
Incompatible
Neutral
Compatible
Fully Compatible
Will this library be modified or distributed outside the organization?
License Compatibility Matrix with Company Products
Product Name | Product License Type | Compatible? | Compatibility Justification or Restrictions | |
|---|---|---|---|---|
Security scanning identifies known vulnerabilities (CVEs) and supply chain risks. Transitive dependencies multiply attack surfaces. This assessment validates that the library meets organizational security baselines and defines remediation timelines. Unmaintained libraries or critical CVEs may constitute an automatic rejection.
Has automated vulnerability scanning been completed using approved tools?
Upload Complete Vulnerability Scan Report
Vulnerability and Risk Tracking Register
CVE Identifier | Severity (CVSS Score) | Vulnerability Description | Is library affected? | Patched Version Available | Exploitability (1=Low, 5=Critical) | Mitigation Actions Taken | |
|---|---|---|---|---|---|---|---|
CVE-2023-12345 | 7.5 | Prototype pollution in merge function | Yes | 4.17.21 | Updated to patched version | ||
CVE-2022-99999 | 9.8 | Remote code execution | N/A | Not affected; functionality not used | |||
Overall Security Risk Score (1=Minimal, 10=Critical)
Have all transitive (indirect) dependencies been analyzed?
Identified Supply Chain Risk Factors
No active maintainer in past 12 months
Single maintainer (bus factor risk)
Typosquatting or namespace confusion potential
Recent repository takeover incident
Cryptocurrency mining code discovered
Obfuscated or minified source code
No signed releases or tags
Known malicious version in ecosystem
Security Mitigation and Monitoring Plan
Does the library have a published security policy and disclosure process?
Date of Last Security Update or Patch Review
This section evaluates the risk of proprietary IP contamination. Copyleft licenses can infect proprietary code if not properly isolated. Static linking creates derivative works; dynamic linking offers better separation. Architecture decisions directly impact IP ownership and competitive advantage protection.
Library Integration Method
Static Linking (compiled into binary)
Dynamic Linking (shared library/.dll/.so)
Runtime Dependency (interpreted at runtime)
Build Tool or Code Generator only
Documentation/Example Code only
Network Service/API Call (SaaS separation)
Will any modifications be made to the library source code?
Has an API abstraction layer or wrapper been implemented to isolate library usage?
IP Risk Factor Assessment
No Risk | Low Risk | Medium Risk | High Risk | Critical Risk | |
|---|---|---|---|---|---|
Proprietary algorithms exposed through library integration | |||||
Library will be embedded in core product differentiator | |||||
Reverse engineering would reveal business logic | |||||
No alternative proprietary library available | |||||
Library touches customer data encryption/handling |
Applied Risk Mitigation Strategies
Separate compilation unit or module
Process isolation (separate microservice)
Container/VM isolation
Network boundary separation
API gateway mediation
Code obfuscation applied
No mitigation applied
Does this library contain any code contributed by non-employees (external contributors)?
Has export control classification review been completed?
Upload Architecture Diagram Showing Library Boundary
IP Risk Justification and Business Necessity
Final approval requires both technical and legal authority acknowledgment of risks and obligations. Conditional approvals may impose restrictions on usage, distribution, or require commercial license procurement. This clearance is time-bound and subject to re-evaluation upon library updates or product release changes.
Chief Technology Officer (CTO) Approval - Do you approve this library integration?
CTO Technical Risk Assessment and Justification
Chief Technology Officer Digital Signature
CTO Approval Timestamp
Lead IP Counsel Approval - Do you approve this library integration from an intellectual property perspective?
IP Counsel Legal Review Summary
Lead IP Counsel Digital Signature
IP Counsel Approval Timestamp
Overall Risk Acceptance Level
Low Risk - Standard Monitoring
Medium Risk - Enhanced Monitoring
High Risk - Quarterly Review Required
Critical Risk - Monthly Executive Review
Clearance Expiration Date (maximum 12 months)
Is an audit trail and usage tracking mechanism required for this library?
APPROVAL CONDITIONS: This clearance is valid only for the specified library version and integration context. Any version changes, modifications, or scope expansions require re-evaluation. The technical owner must monitor security advisories and license changes. Failure to comply with stated obligations may result in product distribution cessation and legal liability.