CAL.COM CLOSES OPEN-SOURCE CODE OVER AI SECURITY RISKS
AI DESK■ 1 MIN READ
WED, APR 15, 2026■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE
Cal.com, a scheduling software provider, is moving its core codebase from open source to a closed repository. The company cited vulnerabilities to AI-powered attacks as the primary reason for the shift.
Cal.com's decision marks a significant departure from open-source principles, driven by concerns that publicly available code can be exploited by AI tools. The company stated the move addresses modern security threats rather than traditional vulnerabilities.
The scheduling platform joins a growing list of companies reconsidering open-source strategies in response to AI capabilities. By closing its core repository, Cal.com aims to reduce exposure to automated code analysis and potential exploitation by machine learning-based attackers.
While the company remains committed to supporting its existing open-source community, the core infrastructure will no longer be publicly accessible. This decision reflects broader industry tensions between transparency and security in the age of advanced AI tools.
The move underscores emerging concerns about how AI systems can identify and weaponize vulnerabilities in publicly shared code at scale—a challenge traditional open-source security models may not adequately address.
■ SOURCES
► Techmeme■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE
■ MORE FROM THE SECURITY DESK
Cybercriminals have transformed DDoS attacks into a polished, commercialized service complete with pricing tiers, customer support, and reseller programs. The DDoS-as-a-Service market has evolved from basic tools into sophisticated attack platforms.
YESTERDAY— Industry Desk
Microsoft faced backlash after threatening a security researcher with criminal investigation, reigniting debate over software vulnerability disclosure practices and corporate responsibility.
YESTERDAY— Security Desk
Google is deploying Device Bound Session Credentials (DBSC) to all Chrome users, a security feature designed to prevent account takeovers by protecting session cookies from theft.
YESTERDAY— Industry Desk
Dutch authorities have dismantled a major botnet comprising 17 million infected devices and seized over 200 servers hosting the operation at a local provider.
YESTERDAY— Security Desk