open-webui/docs
1
0
Fork 0
mirror of https://github.com/open-webui/docs.git synced 2026-07-21 01:55:22 -04:00
Code Issues 37 Packages Projects Releases Wiki Activity

Drop license-score section from the scanner page

Browse Source 
Removes the "License score and N% match license detection" section (and the stray license-score mention in the scores overview) from the Supply Chain and Security Scanners page.
This commit is contained in:
Classic298
2026-07-03 19:32:53 +02:00
parent 84ba86311f
commit ed9ccdc4ee
1 changed files with 1 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/supply-chain-security.mdx
+1 -5
View File
@@ -15,7 +15,7 @@ None of the indicators these scanners raise against Open WebUI correspond to a n
Supply-chain scanners score a package on automated signals: which language features it uses, which system capabilities it can reach, what its dependencies look like and pattern-based classifiers. These signals describe what a package is *capable* of, not whether it *misuses* anything. For a self-hosted AI platform, the capabilities that score highest (running code, reaching the network, invoking a shell) are precisely the product's core, documented features. A high signal count therefore reflects what the software does, not a defect in it.
The headline numeric scores a scanner shows, for example a supply-chain or license score out of 100, are aggregates of these same automated signals, so a score below 100 reflects the heuristic flags described below rather than a count of confirmed defects.
The headline numeric scores a scanner shows, for example a supply-chain score out of 100, are aggregates of these same automated signals, so a score below 100 reflects the heuristic flags described below rather than a count of confirmed defects.
We review each new flag, but a flag is a starting point for analysis, not a finding.
@@ -46,10 +46,6 @@ These originate in transitive dependencies and in the pre-built, minified front-
Container-image CVEs are a separate matter: those originate in the base image, are addressed by rebuilding on updated bases and are not part of the PyPI package scan discussed here.
### License score and "N% match" license detection
Scanners also assign a license "score" (for example 80) and report fuzzy "N% match" results against standard licenses, such as "80% match: BSD-3-Clause" or "80% match: MIT". Open WebUI is published under the [Open WebUI License](/license), a BSD-3-Clause license with an added branding-protection clause introduced in v0.6.6 (the codebase up to and including v0.6.5 remains plain BSD-3-Clause). Because that added clause means the license text is not a byte-for-byte copy of a stock SPDX BSD-3-Clause or MIT template, license scanners report a partial match and reduce their license score accordingly. This is a detection artifact of a deliberate, published, valid license, not a missing license, a license conflict or a compliance risk. The full terms are in the repository's LICENSE file and are explained on our [License page](/license).
### Maintainer count
Scanners report a maintainer count taken from package metadata, often "1 maintainer" for Open WebUI. That figure is the number of accounts with publish rights on the PyPI package, a single release account, not the number of people who develop the project. Open WebUI is built by a core team and a broad base of external contributors, visible in the repository's [contributor history](https://github.com/open-webui/open-webui/graphs/contributors) and on our [Team page](/team). Publishing releases from one account is a common, deliberate packaging practice, not a maintenance bus-factor of one.