---
title: "Public data repository with no licence | Metacenta"
description: "A public repository with no licence grants nobody permission to use it. Why we check only public repositories, and how to state the licence you intend."
url: "https://metacenta.com/rules/repo-unlicensed"
updated: "2026-10-14"
tokens: 660
---

Repository hygiene · rule repo-unlicensed

# Public data repository with no licence

A Metacenta review checks this under the rule **A public repo states its licence**. Everything below applies whether or not you ever commission one.

## What this rule checks

This rule flags a public repository with no licence the host can identify. A licence file the host can't match to a known licence is reported as well, as a separate problem. Private and internal repositories aren't judged. If the host reports no visibility, we decline.

## Why it matters

An unlicensed public repository grants nobody permission to use, modify or contribute to it, whatever the author intended. An unidentified licence gives a would-be contributor's legal team nothing to approve.

## How to fix it

**State the licence of the public repository.** Add a `LICENSE` file holding the unmodified text of the licence you intend. If publication was a mistake, make the repository private instead.

## When it is fine to leave

Publishing code to be read but not reused, with all rights reserved, is a legitimate choice. Say so in the README, so the absence reads as a decision. A private repository needs no open-source licence, which is why we do not check one.

## What we need to check it

Read-only access to the repository's metadata. We use the visibility and the licence identifier the host resolved, not a filename match. So a `COPYING` file can count, and a `LICENSE` file holding something else does not.

## Published rules it corresponds to

**[OpenSSF Scorecard](https://scorecard.dev/)**, rule `License`. Ours checks a subset of what it flags; theirs is stricter. Scorecard scores every repository on whether a licence is present and recognised. This engine asks it only of a public repository. An internal analytics repo is right to carry no open-source licence, and that describes almost every client.

This means our check corresponds to their rule. It does not mean the publisher reviewed or endorses it.

[Ask about a review](https://metacenta.com/enquire?src=rule-repo-unlicensed&via=md)

## Related pages

- [Credential files committed to a data repository](https://metacenta.com/rules/repo-committed-credential-file)
- [Data repository with no CI pipeline](https://metacenta.com/rules/repo-no-ci)
- [Archived repositories under review](https://metacenta.com/rules/repo-archived)
- [Data repository with no tests](https://metacenta.com/rules/repo-no-tests)
- [A sample review, as a client reads it](https://metacenta.com/sample)
- [All published rules](https://metacenta.com/rules)
- [How a review is assessed](https://metacenta.com/standard)