How Stateward protects you against copyleft & source-available license risk
The threat
A single new dependency under GPL/AGPL or a source-available license (SSPL, BUSL, Elastic, Commons-Clause) can impose obligations on your whole product, a legal problem that surfaces at the worst possible time.
How Stateward catches it
Stateward flags copyleft and non-OSI source-available licenses in two places: your own code (an SPDX id, a manifest license field, or a LICENSE file, declaration-context gated, word-boundary aware so LGPL ≠ GPL) and, the part teams miss, the licenses of every dependency you add, resolved from the registry and checked against a per-repo license policy you control (deny AGPL/GPL/SSPL/BUSL by default). One place to keep the whole estate legally clean; licenses also flow into the SBOM.
Recent advisories of this class
- highGHSA-7q9c-hpx7-9cwmTypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
- criticalCVE-2026-73842OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
- mediumCVE-2026-73557 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
- mediumCVE-2026-73556vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
Check your own repo for this
Connect a repo and Stateward reviews your next pull request, read-only, free for individuals and open source.
Built to be trusted with your code
Read-only & ephemeral
Stateward can comment, but never pushes, merges or stores your keys.
EU hosting & data residency
Code and security data stay EU-hosted with EU data residency, built for NIS2, DORA and the CRA.
Whole-codebase aware
Reasons over your call graph and trust boundaries, not just the diff.
Stateward is live and ready to guard your code. Built by Yggdrasil Digital.