Developer Open-Source License Compliance Experience Survey

Welcome! Thank you for participating in this survey about open-source license compliance practices. This should take approximately 11 minutes. Your responses are confidential and will be reported only in aggregate. There are no right or wrong answers — we are interested in your honest experience. Participation is voluntary and you may stop at any time.

In the last 3 months, how often did you write or review production code?

• Daily
• Several times a week
• Weekly
• Less than weekly
• Not in the last 3 months

How confident are you in interpreting common open-source licenses (e.g., MIT, Apache 2.0, GPL) for your own code?

Do you currently use any tools for license compliance (e.g., SCA scanners, SBOM generators)?

• Yes
• No
• Not sure

Rank the following barriers to improving license compliance in your organization from most to least impactful.

1. Unclear obligations or terminology
2. Tooling noise or false positives
3. Lack of time or competing priorities
4. Missing or unclear internal policy
5. Legal review delays or unavailability
6. Complex transitive dependencies

Based on your experience, what one change would make open-source license compliance clearer or easier for you?

What is your primary role?

• Software engineer/developer
• Engineering manager
• Security/compliance engineer
• DevOps/SRE
• Legal/compliance
• Product/Program manager
• Other (please specify)

Thank you for completing this survey. Your responses will help improve open-source license compliance tools, policies, and documentation. Results will be reported in aggregate only.

Which ecosystem do you primarily work in?

• JavaScript/Node
• Python
• Java
• C/C++
• .NET
• Go
• Rust
• Ruby
• Mobile (Android/iOS)
• Data/ML (e.g., R, Julia)
• Other (please specify)

How clear is your organization's open-source license compliance process to you?

Which type of tool is most useful to you for license compliance?

• Software composition analysis (dependency scanning)
• License text scanners
• SBOM generators
• Package manager audit commands
• CI/CD policy gates
• Custom scripts or queries

How valuable is having a software bill of materials (SBOM) for managing license compliance in your projects?

We'd like to explore your compliance experience in a bit more depth. What specific challenges or gaps have you encountered that the previous questions did not fully cover?

How many years of professional coding experience do you have?

• 0–1
• 2–4
• 5–9
• 10–14
• 15+
• Prefer not to say

In the past 6 months, were you involved in selecting, reviewing, or complying with open-source licenses for your code?

• Yes
• No
• Not sure

How clear are each of the following activities in your current workflow?

Overall, how satisfied are you with your current license compliance tooling?

In a typical month, approximately how many hours do you spend on license compliance tasks?

• 0 (none)
• 1–2 hours
• 3–5 hours
• 6–10 hours
• 11–20 hours
• More than 20 hours

Approximately how many employees are in your organization?

• 1–10
• 11–50
• 51–250
• 251–1,000
• 1,001–10,000
• 10,001+
• Prefer not to say

How clear is the process for choosing an appropriate license for a new project or component?

Where are you primarily located?

• North America
• Latin America
• Europe
• Middle East & Africa
• Asia
• Oceania
• Prefer not to say

How clear is the process for reviewing licenses of third-party dependencies before adding them?

How clear is the process for generating or maintaining a software bill of materials (SBOM)?

Where do you typically get guidance on open-source license compliance? (Select all that apply)

• Internal engineering policy
• In-house legal counsel
• Automated tooling or scanner documentation
• Community docs, blogs, or forums
• External legal resources
• Package manager or registry guidance
• None of the above
• Other (please specify)