Forking Cal.com to closed source (Interview)

The podcast discusses significant challenges facing open source software in the age of AI, particularly the influx of low-quality, AI-generated code contributions - referred to as "slop" - that overwhelm maintainers and obscure legitimate security issues. This noise makes it increasingly difficult to identify real vulnerabilities, degrades codebases, and undermines the traditional open source model of community-driven security and collaboration. Some projects are responding by closing external pull requests or shifting to issue-based feedback to manage the volume.

Security risks in open source are escalating, with AI tools enabling both rapid discovery of critical vulnerabilities and easier exploitation by malicious actors. The assumption that open source is inherently more secure is being challenged, as automated attacks and supply chain compromises become more common. In response, some companies are forking their codebases, moving sensitive components to private repositories, and reevaluating their open source strategies - not for commercial gain, but to protect customer data and reduce attack surfaces, while still maintaining community editions for transparency and self-hosting.

• What if you moved your core product's sensitive components to a private fork while keeping the community edition open source?

  • Move: Identify and extract high-risk modules (e.g., database connectors, auth logic) into a private repository; maintain a public "DIY" version with disclaimers.
  • Why Now?: AI-powered scanning tools make public repos 5 - 10x easier to exploit, and supply chain attacks are rising - protecting customer data is urgent.
  • Expected Upside: Reduce attack surface immediately, maintain community trust via open DIY version, and align with security best practices without abandoning open source values.

• What if you adopted a cloud-based development environment for your solo workflow to eliminate local machine risks?

  • Move: Migrate from local laptop development to a secure, reproducible cloud dev environment (e.g., Gitpod, GitHub Codespaces) with strict dependency controls.
  • Why Now?: Laptops are vulnerable to theft, malware (e.g., Shy Hulud), and config drift; cloud environments can be reset in minutes post-compromise.
  • Expected Upside: Faster setup, consistent builds, reduced "it works on my machine" issues, and stronger supply chain security via vetted package sources.

• What if you stopped accepting direct pull requests and shifted to an issue-first contribution model for your open-source project?

  • Move: Disable PR submissions on your repo and require contributors to open issues first - only merge code from trusted collaborators after design alignment.
  • Why Now?: AI-generated "slop" PRs are overwhelming maintainers, often contain hallucinated code, and increase security risks from hidden vulnerabilities.
  • Expected Upside: Regain control over code quality, reduce review burden, prevent noise flooding, and foster higher-signal contributions through structured feedback.

• Move sensitive code components to private repositories - Immediately fork your public codebase and relocate critical parts (e.g., database logic, authentication, encryption) to private repos to reduce attack surface and protect customer data.

• Adopt cloud-based development environments - Replace local laptop development with standardized cloud environments (e.g., Gitpod, GitHub Codespaces) to improve security, ensure consistency, reduce onboarding time, and enable rapid reset in case of compromise.

• Restrict dependency sources to vetted repositories - Configure your build pipelines to allow only approved, private package sources, minimizing supply chain risks from compromised public libraries.

• Pause or filter AI-generated pull requests - If maintaining an open-source project, temporarily disable external PRs or implement automated filtering to block low-quality, AI-generated "slop" that overwhelms review capacity and degrades code quality.

• Conduct an AI-powered vulnerability scan on your public code - Use AI security tools to proactively audit your public repositories for exposed vulnerabilities, especially in code handling sensitive data, and fix them in a private branch before public disclosure.