“One of the projects that we reported vulnerabilities to got so many vulnerability reports, they decided to just stop publishing the source for their application. … The narrative they told was, hey, the existence of powerful models that can just take source code and turn it into vulnerabilities means that it is a liability for us now to have our source code out here. At first, I thought that was a little bit ridiculous. I will say that I think things are definitely changing.”

…want to think about how we can actually get in positive control of some of these security properties and generalize from, hey, like, here's one way in which we were hacked, all the way back to what's the root cause of that, and how can we prevent that from ever being in our systems going forward?

…in. I'm very curious about how this is not just a way to have contribution and also community be involved. I feel like in today's AI world, this is quite a new, a possible way to either find more value for users or for agents. So, I'm very curious, like, what is that continuation for you as well?

Yeah, I'm super interested. So I guess like a few questions and thoughts coming out of that. Like, do you have to be open source to be a successful developer application security company is one. And or does Semgrep have enough trust already in the ecosystem that you can close source new products…

that's a great question. We don't want to like closed source like any of the stuff that we've offered so far. You may know like two years ago, we changed the license for the SymGret rules and we took some stuff out of the open source engine offering, even though the license was still LGPL. That was…

I think it's a really hard problem because traditional open source licenses were very much centered around like distribution, copying code, but training on code is like such a different thing. And how do you enforce that? And also I think the regulatory bodies at B are not up to date with how to…