We couldn't ship software until we cleared every bit of code flagged by a tool that scanned our code for open source. Most of the hits were for projects with a

We couldn't ship software until we cleared every bit of code flagged by a tool that scanned our code for open source. Most of the hits were for projects with a safe license and there were many false positives but all in all it was a great step in our static code analysis. I find it astonishing that a company of any size would skip this step.