Discourse will not go closed source

In response to Cal.com's announcement of a shift to closed source, Discourse pushes back, arguing that closing the source code is not a security solution.

• Discourse emphasizes that it maintains the GPLv2 license and has operated as a public repository for 13 years.
• While AI has greatly accelerated vulnerability discovery, open code lets not just internal teams but also external researchers and contributors join the defense.
• Conversely, even with closed source, the JavaScript shipped to browsers, API contracts, client logic, and runtime behavior are already exposed, so the security benefit is seen as limited.
• In practice, Discourse used tools like GPT-5.3 Codex, GPT-5.4, and Claude Opus 4.6 to scan its codebase over multiple days and find hidden vulnerabilities, and states that in its most recent monthly release it fixed 50 security issues discovered this way.
• The scanning process is detailed as well. After bulk-analyzing controllers, suspicious spots are verified by writing failing tests in an actual Discourse environment inside a container, and if reproduced, they are handed off for human review.
• On the cost side, AI scanning is also getting rapidly cheaper. The author says a full scan might cost around $2,000 at retail, but drops to about $50 on a $200/month plan.
• Discourse's security philosophy is grounded in openness. It explains that combining open code, fast patching, sandboxing, rate limiting, CSP, and least privilege reduces the attack surface, and that once a vulnerability is found, it can be deployed to hosted instances within hours.
• The author locates the real reason behind the shift to closed source not in security but in competitive pressure and governance burden. In other words, the security argument is seen as more of a frame to justify a business decision.
• The conclusion is clear: the more AI makes it easier to find vulnerabilities, the argument goes, the more open source becomes the stronger security model, since more defenders can see the code.