Actually make it open source: AGPL-3.0 - #218
Merged
Merged
Conversation
The repository was already public, and the README said "Proprietary. © CrawlProof." Public source with no licence is not open source — it is all rights reserved with the code visible, so nobody could legally use, copy or modify any of it. The gap was the licence file, not the visibility setting. AGPL-3.0-only, because CrawlProof is a hosted service and section 13 is the clause that matters: running a modified version as a network service obliges you to offer its source to that service's users. Self-host it, fork it, change it, run it inside your own company — none of that obliges anything. Offer it to other people over a network and your changes come back. A permissive licence would have let a competitor host a closed fork, which is a decision to make deliberately rather than by leaving the field blank. TRADEMARK.md draws the line the licence does not: the AGPL covers the code, not the name or the logo. Stated as what you may and may not do, with the practical list of what to rebrand in a fork, because "all rights reserved" on a brand reads as hostile when it is actually about not leaving users unable to tell a fork from the original. Also checked, since the repo is public and its gitleaks workflow cannot run while Actions is billing-blocked: no .env has ever been committed (only .env.example), and nothing tracked matches a live key pattern. 1940 tests pass, typecheck clean. The lockfile change is the one line npm adds for the new licence field. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013cbcXdpLFUgJZuVfCB4Gzv
ThreatCrush Security Scan40 finding(s) HIGH/CRITICAL: 3 | MEDIUM: 28 | LOW: 9
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repository was already public, and the README said "Proprietary. © CrawlProof."
Public source with no licence is not open source — it is all rights reserved with the code visible, so nobody could legally use, copy or modify any of it. The gap was the licence file, not the visibility setting.
Why AGPL-3.0
CrawlProof is a hosted service, so §13 is the clause that matters:
Self-host it, fork it, change it, run it inside your own company — none of that obliges anything. Offer it to other people over a network and your changes come back. A permissive licence would let a competitor host a closed fork; that is a decision to make deliberately rather than by leaving the field blank.
What's here
LICENSE— canonical AGPL-3.0 textpackage.json—"license": "AGPL-3.0-only"(SPDX), so GitHub and tooling detect itTRADEMARK.md— the line the licence does not draw: AGPL covers the code, not the name or logo. Written as what you may and may not do, with the practical list of what to rebrand in a forkSecret check
The repo is public and its gitleaks workflow cannot run while Actions is billing-blocked, so I checked by hand: no
.envhas ever been committed (only.env.example), and nothing tracked matches a live key pattern.1940 tests pass, typecheck clean.
🤖 Generated with Claude Code
https://claude.ai/code/session_013cbcXdpLFUgJZuVfCB4Gzv