Cal.com is switching to closed source

Cal.com is switching from open source to closed source.

The company cited the growing threat of AI-driven security attacks as the reason. Since a public codebase fully exposes its structure to attackers, it judged that AI now makes it much easier to systematically find and exploit vulnerabilities.

The key decisions are as follows.

• The production codebase will move to a private repository.
• Cal.diy will continue to be offered under the MIT license as an open option for the community.
• However, it has already diverged significantly from the actual production code, with core systems such as authentication and data handling in particular having been rewritten.

The company explains that AI security startups have recently been productizing the ability to find vulnerabilities in public code, and that different tools surface different vulnerabilities, making security judgments inconsistent as well. As a result, it now believes that switching to closed source better protects customer data than staying open source.

As an example, it mentions a case where AI found a 27-year-old vulnerability in the BSD kernel and even built a working exploit within a few hours. Given this speed and level of automation, it argues that public code could expose its own app and customer data to greater risk.

In summary, Cal.com has chosen to prioritize security first for now by going closed source, leaving open source available only in the form of Cal.diy.