Licences, and What Public Really Means

Making a repository public means anyone can read it. What they may legally do with it is a separate question, and the default answer surprises most people: nothing.

This page is two things — the licence decision, and an honest look at what "public" exposes. Neither is legal advice; both are decisions you can reasonably make about your own work.

No licence means all rights reserved

Publishing code does not give anyone permission to use it. Copyright applies automatically, and GitHub puts it plainly: without a licence, you keep all rights to your source code and nobody may reproduce it, distribute it, or build anything derived from it.

Almost nobody who omits a licence intends that. They intend "help yourself" and accidentally publish "look but do not touch". A LICENSE file is how you say which one you mean.

The three you will meet

MIT — do essentially anything, including selling it, as long as the copyright notice travels with it. Short, readable in a minute, and the most common licence on small projects.

Apache 2.0 — the same permissiveness with an explicit patent grant and a requirement to state what you changed. Longer, and preferred by companies for exactly that explicitness.

GPL — you may use and modify it, and if you distribute your modified version it must carry the same licence. This is the "copyleft" idea: the freedom travels with the code and cannot be closed off downstream.

One sentence each is the right depth here. Choosing between them is a decision about how you want your work used, and anything with money or an employer involved deserves a real conversation rather than a course.

Adding one

GitHub can create the LICENSE file for you from a template, and shows the licence on the repository page once it exists. You can also add the file by hand — it is ordinary text, committed like anything else.

Either way it takes a minute, and it converts "I published this" into "you may use this", which is presumably what you meant.

What public actually exposes

Everything. Every file, every commit, every message, your name and email on all of them, and the entire history rather than only the current state.

That last point is the one from Chapter 5 arriving as a consequence. A file you committed in week one and removed in week two is still readable in the commits from week one, by anyone, forever.

Before you flip the switch

Three checks, and they take about two minutes.

git log --oneline -- notes/private/
git log --oneline -- .env

Any output at all means the file was committed at some point, whether or not it is there now. If it held a credential, rotate it — the Chapter 5 rule, one last time.

Then read your own commit messages. They are about to be public writing, and a log full of "asdf" is a small, avoidable embarrassment.

And check the README for anything private: a home address, a phone number, a real email you did not mean to publish. Sandpiper's README lists a village hall, which is fine; a member's phone number would not be.