Particle.news
Download on the App Store
4 ARTICLES
·
3w ago

Cal.com Closes Core Code, Releases MIT-Licensed Cal.diy Citing AI Security Risk

Leaders cite AI systems that comb public code for flaws as a new reason to keep production software private.

Illustration of a teal briefcase with a keypad and keyhole lock, set against a dark blue background, depicting the concept of securing software systems and restricting access to code.
Image
Image

Overview

  • Cal.com said it is moving its production code into a closed repository, pointing to AI tools like Anthropic's Mythos that can find and exploit bugs, including a 27-year-old flaw in OpenBSD.
  • The company released Cal.diy under the permissive MIT license as a self-hostable core that keeps scheduling and booking but drops team management, workflows, analytics, and enterprise authentication.
  • Executives said open visibility lowers the cost to hack and noted they had already rebuilt sensitive parts, including authentication and data handling, outside the public codebase.
  • Current self-hosting customers will receive access to a private, on-premise GitHub repository to keep running the product, while hobbyists can use Cal.diy without enterprise features.
  • The move formalizes a split between community code and commercial features that is common in open source businesses and may spur other firms to reevaluate how much code they expose to protect customer data.