Open Source Licensing Conflicts and How to Protect Your Work

The creator of Photopea, Ivan Kutskir, just dropped a comment on GitHub that’s sending ripples through the developer community. His project—a sophisticated browser-based photo editor—is at the center of a licensing controversy involving Photosuite, a project that appears to have borrowed heavily from Photopea’s codebase. The issue isn’t just about hurt feelings or competitive posturing; it’s about the fundamental mechanics of how open source licensing actually works when the rubber meets the road.

For IT professionals managing code repositories, contributing to projects, or building products on existing libraries, this story isn’t just drama—it’s a masterclass in what happens when licensing assumptions collide with reality. Let’s dissect what went wrong and extract the practical skills you need to navigate these waters without getting burned.

Table of Contents

• What Actually Happened in the Photopea-Photosuite Clash
• Understanding Open Source License Types
• How to Implement License Compliance in Your Projects
• Enforcing Your License: When and How
• Preventing License Violations in Your Organization

What Actually Happened in the Photopea-Photosuite Clash

Photopea isn’t open source—it’s a proprietary browser application that Ivan built over years. Photosuite, meanwhile, positioned itself as an “open source” alternative but allegedly incorporated significant portions of Photopea’s code without authorization. When the Photopea creator weighed in on GitHub issue #77, he pointed out the uncomfortable truth: you can’t just clone someone’s proprietary work, slap an open source license on it, and call it legitimate.

This isn’t a hypothetical edge case. Similar scenarios play out constantly: a developer finds minified JavaScript they assume is abandoned, a team reverse-engineers a binary thinking it’s fair game, or contributors unknowingly submit code they don’t have rights to distribute. Each scenario creates legal liability and ethical quagmires that can sink projects and careers.

The practical lesson here isn’t about legal theory—it’s about the concrete steps you take every single day when evaluating dependencies, accepting pull requests, or deciding whether to fork an existing project. If you’re working with code that didn’t originate from your keyboard, you need to understand license compliance at a deeper level than most developers currently do. Resources like Coursera offer specialized courses in software licensing and intellectual property that go beyond surface-level understanding, particularly valuable for technical leads and architects who make these decisions.

Understanding Open Source License Types

Let’s cut through the confusion. Open source licenses fall into two broad camps: permissive and copyleft. Permissive licenses (MIT, BSD, Apache 2.0) let you do almost anything—commercial use, modification, distribution—with minimal strings attached. Copyleft licenses (GPL, AGPL, MPL) require that derivative works maintain the same license, ensuring modifications remain open.

The Permissive Category

MIT is the “do whatever you want” license. You can take MIT-licensed code, modify it, incorporate it into proprietary software, and sell it. Your only obligation: include the original copyright notice. Apache 2.0 adds patent protection clauses, making it safer for enterprise use. When you see a library under MIT, you’re essentially free to use it with minimal friction.

The Copyleft Category

GPL is where things get interesting. If you modify GPL code and distribute it, your modifications must also be GPL. The AGPL takes this further: if users interact with your modified code over a network (like a web application), you must share the source. This “network copyleft” catches many developers off guard who assumed SaaS offerings had a loophole.

The “No License” Trap

Here’s where Photosuite apparently stumbled. Code without an explicit license isn’t public domain—it’s the opposite. The creator retains all rights. On GitHub, even public repositories don’t grant you redistribution rights unless the repository includes a recognized license file. This catches developers constantly because public visibility feels like permission, but legally it’s not.

How to Implement License Compliance in Your Projects

Theory doesn’t matter if you can’t operationalize it. Let’s look at practical tooling and workflows that catch license issues before they become problems.

Automated Dependency Scanning

Every modern project uses dependencies. Those dependencies have licenses. If you’re pulling in an AGPL library into your proprietary SaaS product, you’ve just created a compliance nightmare. Tools like license-checker for Node.js or pip-licenses for Python scan your dependency tree and flag problematic licenses.

# For Node.js projects - scan all dependencies and output to JSON
npx license-checker --json --out licenses.json

# Filter for problematic licenses (GPL, AGPL)
npx license-checker --summary --exclude "MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause"

This command scans your node_modules and identifies any package that isn’t under one of the approved permissive licenses. Run this in CI/CD pipelines to catch violations before they reach production. For Python environments, the equivalent workflow looks like this:

# Install pip-licenses and generate a comprehensive report
pip install pip-licenses
pip-licenses --format=markdown --with-urls --output-file=LICENSE_REPORT.md

# Check for copyleft licenses specifically
pip-licenses | grep -E "GPL|AGPL|LGPL"

Integrate these checks into your pre-commit hooks or CI workflows. A failed license check should block merges just like failed tests do. Many teams I’ve worked with treat license compliance as a nice-to-have until they receive a cease-and-desist letter or face an audit—by then, remediation costs orders of magnitude more than prevention would have.

For deeper understanding of how software supply chains and dependency management intersect with security and compliance, platforms like DataCamp offer practical courses that walk through real-world scenarios in software engineering and DevOps practices, including license management workflows.

Creating a License Inventory

Don’t just scan once. Maintain a living document—a THIRD_PARTY_LICENSES.md file in your repository that lists every external component, its version, its license, and where you obtained it. When disputes arise, this documentation proves due diligence. It also makes onboarding new developers faster because they can immediately see what constraints the codebase operates under.

Enforcing Your License: When and How

Let’s flip perspectives. Suppose you’re Ivan Kutskir, and someone just packaged your years of work into a “competitor” project. What are your options?

Technical Enforcement

First, document everything. Screenshots, archived copies of the infringing repository, commit histories showing the timeline. GitHub makes DMCA takedown requests straightforward, but you need evidence. A DMCA notice requires you to identify specifically what was copied and where it appears in the infringing work.

The form itself is surprisingly simple—you fill out GitHub’s web form, specify the repository, identify yourself as the rights holder, and provide a good-faith statement that you believe the use is unauthorized. GitHub typically responds within 24-48 hours by disabling the repository until the matter resolves. However, this is a blunt instrument. It doesn’t recover damages or force attribution; it just removes the immediate problem.

The Communication Strategy

Before legal escalation, many creators reach out directly, as Ivan did on that GitHub issue. This serves multiple purposes: it creates a public record, demonstrates good faith, and often resolves the matter faster than legal channels. In open source communities, reputation matters. A polite but firm explanation of the violation, with specific technical evidence, often produces results because maintainers want to avoid being labeled as bad actors.

When drafting such a message, be specific: “Lines 245-687 of your file X appear to be identical to my proprietary file Y, created on [date], as evidenced by [unique identifiers, unusual function names, identical comments].” Vague accusations get ignored; specific technical evidence gets action.

Preventing License Violations in Your Organization

The best license dispute is the one that never happens. Here’s how to build a culture and infrastructure that prevents violations from occurring in the first place.

Contribution Guidelines

Every pull request should include a certification that the contributor has the right to submit the code under your project’s license. The Linux kernel uses a Developer Certificate of Origin (DCO) that contributors sign off on with every commit. Implement something similar via a CONTRIBUTING.md file that explicitly states:

• Contributors must have authored the code themselves or have permission to contribute it
• Code cannot be copied from proprietary sources, even if publicly visible
• Dependencies must be reviewed and approved before inclusion

Pair this with required checkboxes in pull request templates that force contributors to affirm they’ve read and agree to these terms. It won’t stop determined bad actors, but it creates a paper trail and deters casual violations.

Code Review with a License Lens

Train your reviewers to spot suspicious code. A pull request that suddenly introduces a sophisticated algorithm the contributor couldn’t possibly have developed alone? Red flag. Perfect, production-ready code with no iteration? Suspicious. Code with comments in a different style or language than the rest of the codebase? Investigate.

One practical technique: search for distinctive variable names or function signatures in Google and GitHub. If you find exact matches in other projects, investigate further. This takes seconds and can prevent months of legal headaches.

The Bigger Picture

The Photopea-Photosuite controversy reminds us that open source isn’t lawless territory—it’s governed by licenses that carry real legal weight. Whether you’re choosing a license for your own project, evaluating dependencies, or reviewing contributions, the decisions you make today determine whether you’re building on solid ground or a legal minefield.

Mastering license compliance isn’t glamorous, but it’s foundational. It protects your work, respects others’ rights, and keeps your projects viable long-term. The tools and workflows we’ve covered—automated scanning, license inventories, contribution policies—transform compliance from an afterthought into a managed, systematic process. Start implementing them today, before you become the next cautionary tale circulating on Hacker News.