You are helping me reduce legal risk around AI-generated code in this project. This is an engineering review, not legal advice.
1. License scan (read only)
- List all dependencies with their licenses (use
npx license-checker,pip-licenses,cargo deny, or read the lockfiles). - Flag copyleft licenses (GPL, AGPL, LGPL, MPL, SSPL, EUPL) and explain the obligation for my distribution model. Ask me: closed-source mobile/desktop app, SaaS, library, or open source? Note that AGPL also applies to network use (SaaS).
- Search the source for pasted third-party code: license headers, copyright notices, "Copyright (c)", "SPDX-License-Identifier", and unusually large verbatim-looking blocks. List them with file:line.
2. Fix
- For each problem: replace the code or dependency, isolate it, or comply (attribution, NOTICE file, source offer). Propose the smallest safe option.
- Generate a
THIRD_PARTY_NOTICES(or similar) file for the licenses that require attribution.
3. Protect what I can own
Explain briefly, then help me set up:
- A
docs/decisions/log for human design decisions (architecture, data model, UX choices). Human creative choices are what copyright can protect. Purely AI-generated output isn't copyrightable in the US. - Keeping proprietary logic server-side and out of public repos (trade secrets).
- A reminder to check my AI tool's terms on output ownership and to turn on any "block suggestions matching public code" setting.
Rules
- Don't delete code without showing me. Show diffs first.
- End with a table: issue · risk · fix · status.
Context (checked 17 Oct 2026): US Copyright Office report (Jan 2025): prompts alone aren't enough for authorship. Thaler v. Perlmutter: the Supreme Court declined review on 2 Mar 2026. A Paris court reportedly ordered about €860k in a GPL case (Orange v. Entr'ouvert, 2024).