MFC releases update of Didge android app. Get your update on
Google Play
Ctrlk
Book a meetingGo to websiteLogin to Didge
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Open Source Use

1. Purpose

The purpose of this policy is to establish clear guidelines for the responsible and legally compliant use of open-source software (OSS) in the development, distribution, and maintenance of MFC Safe’s products and platforms, including the Didge platform.

2. Scope

This policy applies to all employees, contractors, and third-party collaborators involved in software development, system integration, or deployment of MFC Safe products where OSS may be used.

3. Policy Statement

MFC Safe supports the use of open-source software to accelerate development, foster innovation, and reduce costs, provided such use complies with applicable licenses and aligns with the organization’s business and security requirements.

4. Guidelines

4.1 Approved OSS Licenses

  • Only OSS under widely accepted licenses (e.g., MIT, Apache 2.0, BSD, LGPL) may be used without prior approval.

  • GPL or copyleft licenses requiring source disclosure must be reviewed by legal/compliance.

4.2 Usage Approval

  • All OSS libraries and tools must be recorded in the OSS inventory.

  • High-risk or copyleft-licensed OSS components require review and approval from the legal and security team.

4.3 Documentation Requirements

  • OSS components must be documented with:

    • Name and version

    • Source or repository link

    • License type

    • Integration purpose

  • This documentation must be maintained in the software bill of materials (SBOM).

4.4 Compliance and Obligations

  • License terms such as attribution, source distribution, and patent clauses must be honored.

  • No modifications to OSS are to be made without clear documentation and impact analysis.

4.5 Vulnerability Management

  • OSS components must be regularly scanned for vulnerabilities using automated tools (e.g., Snyk, OWASP Dependency-Check).

  • Patches and updates must be tracked and applied per the vulnerability management policy.

4.6 Contribution to OSS Projects

  • Developers must obtain approval before contributing code to external OSS projects under the MFC Safe name or using company resources.

5. Roles & Responsibilities

Developers

Identify and request approval for OSS use

Legal/Compliance

Review licenses and obligations

Engineering Leads

Maintain OSS inventory and ensure policy compliance

Security Team

Monitor vulnerabilities and license risks

6. Exceptions

Any deviations from this policy must be documented and approved by the CTO and legal team.

7. Enforcement

Violations may lead to revocation of development privileges, legal consequences, or disciplinary actions.

8. Review Cycle

This policy shall be reviewed annually or when significant changes to OSS usage practices arise.

PreviousEthical AI & Data Use
NextCode of Conduct

Last updated

Was this helpful?