GitHub Code in a Commercial Product: Licenses and What to Check

You’re building a product and find a ready-made piece on GitHub: a library, a template, an entire project that does exactly what you need. Claude suggests pulling it into your project. And then you pause: the code seems to be publicly available, but can you actually use it, let alone sell a product that includes it? Could the author come after you later?

I’ll go through this in order: why open code on GitHub isn’t permission by itself, which licenses let you use code and sell a product, which copyleft conditions can require corresponding source for a covered work, and how to check a license in a minute before using the code. No “it depends on the situation.”

Practical information about working with Ailoot is in the documentation.

Is it true that if code is on GitHub, you can use it for free?#

The main trap here is the word “open.” You can see the source code, so it seems that because it wasn’t hidden, you’re allowed to use it. That logic is wrong. “Open to read” and “licensed for use” are different things.

By default, any creative work, including code, is protected by copyright from the moment it is created. Until the author explicitly grants permission, you may not use it. That’s how GitHub describes it on its own license reference page.

The second layer is GitHub itself. People think that because they agreed to GitHub’s rules by publishing code, they can also use other people’s code from there. The rules say exactly the opposite. By making a repository public, the author lets others only view and fork it—that is, make a copy within GitHub itself. That doesn’t authorize using the code in your own work.

The key words are in the last sentence: “within GitHub’s features” and “additional rights come from a license.” A fork stays within GitHub. As soon as you want to use the code in your own product, let alone sell it, you need a separate license from the author. No license, no right—even if the code is right there in plain sight.

What determines whether you can use someone else’s code?#

It all comes down to one file. A properly maintained repository contains a license file—usually LICENSE, sometimes LICENSE.md, or a mention directly in the README. This is the author’s permission, which states the terms under which you may use the code. GitHub usually displays the license name in the repository page’s sidebar, before you even open the file itself.

To avoid getting lost in legal language, it’s useful to read the license through three questions about your situation:

1. Can you use this code in a commercial product that people pay for?
2. Can you modify the code for your needs?
3. Do you have to open your product’s source code afterward, or can you keep it closed?

Almost all the differences between licenses come down to different answers to the third question. For the first two, popular open licenses most often say “yes”: use it, modify it, sell it. But whether the license will make you open your own code is where people stumble. Next, we’ll go through the main types using these three questions.

Which licenses let you use code and sell a product?#

Let’s start with good news. For someone building a product to sell, the best option is a group of licenses called permissive licenses. There are several, but three are most common: MIT, Apache 2.0, and BSD. All three answer “yes” to the first two questions and let you keep your own source code closed.

The most common and simplest is MIT. Its text fits in a single paragraph.

In simpler terms, MIT lets you do almost anything with the code, including selling the product and keeping your own source code closed. The only obligation is to include the license text and attribution line. Babel, .NET, and Rails, for example, are released under MIT, so you’ve almost certainly used code under this license already.

Apache 2.0 works similarly, but adds two important points. First, explicit protection against patent claims: the code’s authors promise not to sue you over patents on this code. Second, a few more formal requirements for use.

BSD (in its 2-clause and 3-clause versions) is essentially similar to MIT: use it, modify it, sell it, preserve the copyright notice. I’ve put all three in a table so you can see the difference at a glance.

How to read this for your own use: if you see MIT, Apache 2.0, or BSD on someone else’s code, you can relax: you can use it in a commercial product, modify it, and keep your own source code closed. You only need to avoid removing the license file and attribution from the part you took.

How do GPL and AGPL source obligations apply?#

Copyleft keeps a covered work and its derivatives under the same license when the relevant conditions apply. Under GPLv3, distributing source or object-code copies of a covered or combined derivative work requires compliance with its license and corresponding-source obligations. It does not automatically apply to every independent program in the same product or server.

Take the web-service example. Hosting a GPL library on your own server without giving users copies does not, by itself, require publishing the whole service. Distributing a covered combined application to customers can trigger GPL duties; check the code’s integration and license before deciding what source must accompany it. A browser client delivered to users is a separate distribution question.

AGPLv3 adds a network condition: if you modify the program and users interact with that version remotely, it must prominently offer those users its corresponding source. This is more precise than saying that merely hosting any AGPL component opens every independent part of a service.

For a proprietary product, examine the covered work, how components combine, whether copies are distributed, and whether AGPL network interaction applies. Choose a compatible permissive alternative or obtain separate permission if you cannot meet the relevant obligations. Commercial use itself is allowed; the issue is compliance with the actual license and integration.

What should you do if the repository has no license file at all?#

A common mistake is to assume that if there’s no license, there are no restrictions and you can use the code freely. It’s the opposite. No license is not permission; by default, it means no permission. The code without a license remains under the author’s full copyright, and you may not touch it.

The rule we started with applies again: by default, code is protected by copyright, and without explicit permission you may not copy, modify, or distribute it. The ability to view and fork it within GitHub doesn’t break through that barrier—it doesn’t grant you the right to use the code in your own product.

What to do in practice if the code has no license but you really need it:

1. Write to the author. Directly in the repository’s discussions section or by email, ask whether you can use the code and under what terms. Sometimes the author simply forgot to add a license and will add one if asked.
2. Look for a replacement. For almost any task, there’s a second, third, and tenth similar repository—you’ll find one with a proper MIT or Apache license among them.
3. Don’t use it. If you don’t have permission and there’s no replacement, the code isn’t yours, and you can’t put it in a product you intend to sell. The temptation to think “who’s going to find out?” ends badly right when the product starts making money and attracting attention.

What if Claude itself added someone else’s code to the project?#

There’s a second layer here, and it’s easy to confuse with the first. It’s one thing when you visit a repository and copy a file from it: then everything above about the license is your direct obligation. It’s another when Claude writes code for you in response to a request.

In ordinary cases, AI produces its own text, assembled for your task, rather than a copy of someone else’s file. Then the question shifts to a different area: who owns the generated code, and can you sell it? That’s a large topic of its own, and I covered it in an article about who owns code written by AI.

But there’s an exception to keep in mind. Sometimes AI produces a recognizable piece of someone else’s code almost word for word—a whole function from a well-known library. In that case, the library’s license still applies, regardless of who physically pressed the keys. So large ready-made blocks that Claude pulled in wholesale should be checked just as if you had copied them yourself.

How to check a license before using code: steps to follow#

Let’s put it all into a short checklist for checking any third-party code before you bring it into your project. Go from top to bottom.

1. Find the license name on the repository page

   Open the repository on GitHub. The license name is usually visible in the right column or below the file list—for example, “MIT License,” “Apache-2.0,” or “GPL-3.0.” If it’s blank and there’s no license file, that’s already a red flag; come back to it in the last step.

2. Open the license file itself

   Find LICENSE, LICENSE.md, or COPYING in the file list and open it. Make sure the name matches what’s shown in the sidebar and that the license applies to the code you’re using, not just to a separate part of the repository.

3. Identify the type: permissive or copyleft

   MIT, Apache 2.0, and BSD are permissive; you can use the code in a closed commercial product. GPL and AGPL are copyleft; check the covered work, distribution, and any AGPL network condition before determining the source obligations. The name alone does not establish which independent components are covered.

4. Compare it with your situation

   Answer three questions: are you selling the product, are you modifying the code, and do you want to keep the source code closed? MIT, Apache, and BSD work for a closed product for sale. For GPL and AGPL, determine which covered or combined work would need corresponding source and when the obligation is triggered; assess whether you can meet those conditions.

5. No license means don’t use it

   If there’s no license file and the README says nothing about permission, you may not use the code. Write to the author and ask for permission or find an equivalent with a proper license. “It’s publicly available” is not permission.

This check seems tedious right up until the first time your product grows, starts making money, and someone asks about the third-party code inside it. Two minutes at the start cost less than dealing with a dispute later. I cover separately what to do with your product after that so it doesn’t stall after launch: I built a product with AI; what’s next.

Open Ailoot.