Open source components now sit inside the overwhelming majority of commercial codebases, yet most companies cannot say what those components obligate them to do until a customer, an investor, or an acquirer forces the question. This article maps the licensing traps buried in enterprise software and the doctrines that make them dangerous, following an invented robotics company that receives a source-code demand and opens a financing data room in the same week. It explains why breaching an open source license can be copyright infringement rather than mere contract breach under Jacobsen v. Katzer, how the permissive-versus-copyleft taxonomy and the strong, weak, and network copyleft spectrum actually operate, and where the derivative-work and linking questions remain unresolved. It works through license incompatibility, software composition analysis and SBOMs, and an enforcement environment that now includes the SFC v. Vizio third-party-beneficiary theory, the Neo4j restrictions cases, European damages awards, and competitor weaponization. It closes with the relicensing wave, the AI-generated-code provenance problem, and a phased audit framework. The governing lesson is that open source exposure is cheapest to fix before anyone else discovers it.