Scoping Open-Source License Risk Inside a Ten-Day Window

Automated scanners produce hundreds of findings within an hour. The work that matters is deciding which of those findings actually touch distributed code, and which live in build tooling where the obligation never triggers.

Triage order

• Separate runtime dependencies from build and test tooling
• Isolate strong copyleft licenses in anything shipped or hosted with modification
• Confirm contributor assignment and provenance for acquired or contracted code
• Document each accepted exposure with the reasoning, not just the license string

A clean finding with a documented rationale survives buyer counsel review. An unqualified scanner export does not, and it invites a second round of questions at the worst point in the timeline.