Create a license policy and rules

Release status

License policies are available for Enterprise plans and apply only to Snyk Open Source scans.

See Pricing plans.

Group administrators can configure the following settings for each license:

• Level of severity: Values include None, Low, Medium, and High.

  • When None is selected, instructions cannot be inserted since licenses marked with None do not appear in any Snyk test results.

  • New licenses added by Snyk inherit the Unknown license type severity. In cases where this severity is not set to None, newly added licenses appear in Snyk test results.

• Legal instructions for developers: Enter free text to provide any necessary instructions for developers.

  • Snyk recommends describing the specific policy of your company, explaining the need for collaboration from your developers as well as providing them with step-by-step instructions if any are needed

  • Legal instructions will appear in the CLI results, in PR Checks, and on issue cards in the Project view

View and edit license policies

If your company account has one or more Groups, follow these steps to view and edit the License policy settings:

1. Use the Switch Group selector and choose a Group to open its overview.

   

   Switch Group
2. Navigate to Policies > Policy manager > License policies > Organization and choose the policy you want to edit.

   

   Choose the policy to update

The License policy screen displays the list of Organizations that the policy applies to, a policy description, and the licenses included in the policy.

You can edit the license severities and instructions.

License policy overview

Assign rules and severities for a license policy

1. In the Policy manager, navigate to License policies > Organization, and choose a policy link to open the License policy screen.

2. To set the severity for specific licenses, click the Severity selector on the License policy screen, and choose a Severity level to define which license issues you want to identify when Snyk tests run. If you select a severity other than None and want additional instructions or fix recommendations to appear when that license issue is identified, select the instructions icon to the right of the Severity dropdown and enter the text for the license instruction.

3. Click Add or Update to confirm your changes.

4. Click Submit to save your policy.

Update license policy instructions

Submit policy instructions

The updated severities or instructions or both are automatically updated on Snyk servers. When the next scheduled test runs or when a user re-tests a Project, updated results are delivered according to these changes. See License policy results for details.

Set severity for the Unknown license type

The Unknown license type indicates Snyk has not recognized a license for a given package version. You can set a severity level for Unknown, for example, to ensure these license issues are given a higher severity and so appear more prominently in results.

Scroll down the licenses list on the right of the policy you are editing, then select the Severity dropdown for the Unknown license type:

Set severity for Unknown license type

Snyk applies the severity level set for Unknown to new licenses when Snyk adds them to your license policy.