Licenses
License and third-party notices
Effective May 14, 2026. This page separates the MIT source-code license from hosted-service terms and summarizes dependency license evidence tracked for release review.
Licenses
Source license, hosted terms, and dependency notice posture.
Use this page to understand how repository code licensing, third-party notices, and hosted-service obligations are separated.
Repository source-code license
The MicroSaaS Factory repository source code is licensed under the MIT License in the repository LICENSE file. The MIT source-code license grants code-use rights for the repository materials it covers, subject to the license notice and permission terms.
Hosted service terms remain separate
The MIT source-code license does not replace the hosted-service Terms of Service, subscription rules, privacy commitments, third-party service terms, trademark rights, billing obligations, or user-content permissions that apply to MicroSaaS Factory accounts and workspaces.
Third-party dependency notices
Dependency license evidence is derived from package-lock.json and sbom.cdx.json. The checked-in THIRD_PARTY_NOTICES.md file groups observed license families, direct dependency licenses, notable review items, and packages with missing lockfile license metadata.
Review items
The dependency graph includes LGPL-3.0-or-later, MPL-2.0, CC-BY-4.0, Python-2.0, BlueOak-1.0.0, and a lockfile entry for limiter without license metadata. These items should remain visible during release review, container distribution, and SBOM sign-off.
MIT
Primary repository license and the most common dependency family.
Apache-2.0
Used by Firebase, Google Cloud, Playwright, TypeScript, and related dependencies.
BSD-2-Clause / BSD-3-Clause / ISC / 0BSD
Permissive dependency licenses carried through the Node dependency graph.
MPL-2.0
Observed in tooling dependencies such as axe-core and Lightning CSS packages.
LGPL-3.0-or-later
Observed in Sharp/libvips platform packages and kept visible for distribution review.
CC-BY-4.0 / CC0-1.0 / BlueOak-1.0.0 / Python-2.0
Observed in transitive package metadata and tracked in the notices file.