Closing the Door on AI Security

Cal.com is moving its production codebase from a public repository to private, and will operate as closed source going forward.

The reason is the spread of AI security threats. The judgment is that AI can systematically comb through open source codebases to find vulnerabilities, and that the same capability is readily available to attackers as well.

Instead, the company is releasing Cal.diy to the community under the MIT license. However, it has already diverged significantly from the production code, and in particular core systems like authentication and data handling have been rewritten on a large scale.

The company claims that AI can quickly find old vulnerabilities and even turn them into actual exploits, and explains that keeping the code open source would expose customer data and the service to greater risk. For now, it is choosing closed source to prioritize security, but has left open the possibility of returning to open source if the security landscape changes in the future.