Notices and License Information

Why this document exists and what it is not

An SBOM is an inventory kept for your own diligence. A notices file is a licence obligation: most open source licences require that you distribute their copyright notice and licence text with the software. They are different documents and having the first does not satisfy the second.

Trooth holds a good SBOM. This is the notices file, and it is generated from the installed tree rather than from the dependency manifest, so it reflects what is actually shipped.

The finding worth reading first: one dependency is not open source at all, and two carry obligations beyond attribution. Section 3 covers all three.

The tree

The three that need attention

GSAP is not open source, and is free anyway

gsap version 3.15.0 declares Standard 'no charge' license: https://gsap.com/standard-license. That is a proprietary licence, not an open source one, so a licence scanner will flag it and a diligence reviewer will ask about it. The answer is below.

Read 25 August 2026, and closed. Webflow acquired GreenSock and made the entire GSAP toolset free, including the bonus plugins that were once behind a Club GSAP membership, for commercial use and at no charge. The package README bundled with version 3.15.0 states it directly. The standard licence grants a non-exclusive, worldwide licence to use, reproduce, display and implement GSAP for permitted uses, which include websites and web applications for any person or entity.

The one restriction that matters is narrow: GSAP may not be used to build a no-code tool that lets users create visual animations in a way that competes with Webflow. Trooth is an evidence and trust platform and ships no animation builder, so the restriction does not reach us. There is no tier to buy and no payment owed.

Two things worth recording rather than forgetting. GSAP's terms have changed more than once, so the answer above is dated and belongs to version 3.15.0; a future major deserves a fresh read. And the whole dependency exists for one component, the card fan on the buyers page, which is the only file in this repository that imports it.

Vercel Analytics carries weak copyleft

@vercel/analytics version 1.6.1 is MPL-2.0. Using it unmodified is fine and requires only the notice below. If any MPL-2.0 file is ever modified, the modified file's source must be made available under the same licence. That is a file-level obligation, not a project-level one, so it does not affect the rest of the codebase.

Geist is a font licence, not a code licence

geist version 1.7.2 ships under the SIL Open Font License. The OFL permits bundling and redistribution and requires the notice to travel with the font. It also prohibits selling the fonts by themselves and reserves the font name.

Trooth's own typography uses Google Sans and Google Sans Text with Arial declared as the tested fallback, so the practical exposure here is small. The notice is still required wherever the package ships.

Attribution

The following notice satisfies the attribution requirement for the MIT, ISC and Apache-2.0 packages in the tree. It belongs in the product, reachable from the site footer, not only in this folder.

Portions of this software are provided under the MIT License, the ISC License and the Apache License 2.0. Copyright belongs to the respective authors of each package listed in this document. Permission notices and full licence texts are available from each package's repository, and a complete copy is distributed with the application at /legal/notices.

Apache-2.0 additionally requires that any NOTICE file shipped by the package be reproduced. Three packages in the tree are Apache-2.0; their NOTICE files, where present, are reproduced in the generated file the command in section 6 writes.

Direct runtime dependencies

Versions are as installed, which is not always what package.json requests. Two packages resolved above their declared range: lucide-react at 1.17.0 against ^1.16.0, and tailwind-merge at 3.4.0 against ^3.3.1. That is caret resolution working as designed and is recorded here because a notices file states what shipped, not what was asked for.

Keeping this document true

This file is generated. Regenerate it whenever a dependency is added, removed or upgraded, which in practice means whenever pnpm-lock.yaml changes.

node -e '
const fs=require("fs"),path=require("path");
const prod=Object.keys(require("./package.json").dependencies);
const rows=[];
for (const p of prod) {
  const j=JSON.parse(fs.readFileSync(path.join("node_modules",p,"package.json")));
  rows.push([j.name, j.version, j.license || "UNSTATED"]);
}
rows.sort().forEach(r=>console.log(r.join(" | ")));
'

A licence that reads UNSTATED is a finding, not a formatting problem. A package that declares no licence grants no rights, and the correct response is to read its repository or remove it.

The check this should become

scripts/ already holds nineteen dependency-free gates. A twentieth belongs here: fail the build when a package in the tree declares a licence outside an allow-list, or declares none. It would have surfaced the GSAP licence the day it entered the tree rather than during a document review, and it is perhaps thirty lines.

Allow-list to start from: MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, Unlicense. Everything else fails and is added deliberately with a comment saying who approved it.