The whole category in one page.
OPEN SOURCE IS LICENSED, NOT UNOWNED — USE IS PERMITTED ON THE LICENCE'S TERMS AND IGNORING THEM IS INFRINGEMENT
Read the licence file in the actual version you are using, because projects change licences and reputation tells you nothing.
MOST OBLIGATIONS TRIGGER ON DISTRIBUTION RATHER THAN INTERNAL USE, THOUGH SOME LICENCES EXTEND TO SOFTWARE PROVIDED OVER A NETWORK
FREE TO ACQUIRE IS NOT FREE TO OPERATE
Support, security, updates and compliance all become yours. Establish who fixes it when it breaks before deploying anything important.
GENERATE YOUR COMPONENT INVENTORY RATHER THAN MAINTAINING IT BY HAND, BECAUSE MANUAL INVENTORIES ARE WRONG WITHIN WEEKS
Include indirect dependencies, since most components in a typical project were never chosen deliberately.
MOST OF YOUR VULNERABILITY EXPOSURE COMES FROM CODE YOU DID NOT WRITE — SCAN REGULARLY, AND MAKE SURE SOMEONE ACTS ON THE RESULTS
CONTRIBUTE YOUR FIXES UPSTREAM, BECAUSE LOCAL MODIFICATIONS MUST BE REAPPLIED AT EVERY UPDATE FOREVER
BEFORE RELEASING ANYTHING, AUDIT THE FULL VERSION CONTROL HISTORY FOR CREDENTIALS AND INTERNAL INFORMATION — IT PERSISTS AND IT IS SEARCHABLE
NEVER MOVE EXISTING OPEN CAPABILITY BEHIND PAYMENT, SINCE IT DAMAGES TRUST IRREVERSIBLY AND IT IS REMEMBERED
AND TELL CLIENTS WHAT OPEN SOURCE YOUR DELIVERABLE CONTAINS BEFORE YOU BUILD IT, BECAUSE SOME ORGANISATIONS PROHIBIT CERTAIN LICENCES ENTIRELY AND DISCOVERING IT AT DELIVERY MEANS REBUILDING
