In 2023, the maintainers of the MIT-licensed database tool SQLite-vec noticed a sudden spike in usage metrics from a Fortune 500 company. The company had forked the project, rebranded it internally, and was running it as a critical piece of their production pipeline. Zero pull requests, zero bug reports, zero documentation contributions from the corporation. No license violation had occurred. The maintainers had no legal recourse. They simply had a receipt for unpaid labor.

This story is not unique. Across the open source ecosystem, maintainers watch as corporations fork their projects, add proprietary layers, and sell the resulting product—all while contributing nothing back. The tension between open source ethos and corporate extraction has reached a breaking point. But a new wave of governance models, licensing innovations, and billing mechanisms is emerging. Maintainers are learning to bill the corporations that fork their stacks, turning a relationship of extraction into one of mutual investment.

The Fork That Became a Receipt

A fork is a copy of a project's source code that evolves independently. In open source, forking is a legal right—a feature of the license. Permissive licenses like MIT, Apache 2.0, and BSD explicitly allow it. The intention is to foster innovation: anyone can take the code, improve it, and perhaps contribute back. But in practice, many corporate forks never contribute. They consume the work of maintainers without reciprocating.

The economics are lopsided. Maintainers invest thousands of hours writing code, reviewing patches, managing issues, and writing documentation. A corporation forks the project, adds a thin commercial layer, and sells it as a managed service or proprietary product. The maintainer sees usage grow but receives no revenue, no recognition, and often no acknowledgment. The fork becomes a receipt for unpaid labor—a visible record of value extracted without compensation.

Consider the case of a popular JavaScript framework that was forked by a cloud provider. The provider packaged it as a serverless runtime, charged customers per invocation, and never sent a single pull request upstream. The maintainer, a solo developer, eventually abandoned the project after burnout. The fork survived, but the original community dissolved. The receipt was clear: the corporation extracted the value, and the maintainer paid the cost in time and health.

This dynamic is not limited to small projects. Even well-funded foundations struggle. The NGINX ecosystem saw a similar pattern when Cloudflare forked it into OpenResty, adding Lua scripting capabilities and selling a commercial product. The original maintainers received nothing. The fork became a product, and the original project was left to compete with its own derivative.

Why Licenses Alone Can’t Collect the Bill

Permissive licenses are the foundation of open source, but they are also the reason corporate forks are so easy. MIT and Apache 2.0 allow anyone to use, modify, and distribute the code for any purpose—including commercial use—without paying a dime. There is no obligation to contribute back. The license is a one-way door: code flows out, but nothing is required to flow in.

Copyleft licenses like GPL and AGPL enforce sharing, not payment. A corporation that forks a GPL-licensed project must release its modifications under the same license. But that still doesn't require a financial contribution. The corporation can hire its own developers to maintain the fork and never pay the original maintainers. Copyleft ensures code parity, not economic parity.

Dual licensing—offering the project under both a permissive license and a commercial license—works only if the maintainer owns all copyright. That is rare for community projects with many contributors. Each contributor must sign a Contributor License Agreement (CLA) assigning rights, which creates friction and reduces participation. CLA requirements burden small maintainers who lack legal resources.

Legal recourse is slow and expensive. A maintainer could theoretically sue for trademark infringement if the fork uses the project's name, but trademark law varies by jurisdiction and requires registration. Most maintainers cannot afford the legal fees. The result is a system where licenses provide permission but not protection, and the bill remains uncollected.

The Cloudflare Playbook: When a Fork Becomes a Product

Cloudflare's fork of NGINX into OpenResty is a textbook example of corporate extraction. NGINX, originally developed by Igor Sysoev, is a high-performance web server and reverse proxy. Its permissive 2-clause BSD license allowed Cloudflare to fork it and add a Lua scripting module, creating OpenResty. Cloudflare then built a commercial product—Cloudflare Workers, a serverless platform—on top of OpenResty. The original NGINX maintainers saw no revenue from this usage.

Community resentment grew. NGINX developers felt used. Cloudflare, in turn, framed its fork as innovation, contributing some patches back but never addressing the core economic imbalance. The fork outcompeted the original in certain niches, drawing developer mindshare away from the upstream project. Eventually, NGINX's parent company, F5, attempted to relicense NGINX under a more restrictive license—a move widely seen as a reaction to this extraction dynamic.

The lesson is stark: forks can outcompete originals when backed by corporate resources. The fork benefits from the maintainer's years of unpaid work, then adds proprietary value that the original cannot match. The maintainer is left with a choice: compete with a well-funded fork, or abandon the project. Neither option is fair.

But the Cloudflare story also highlights a path forward. After community backlash, Cloudflare increased its contributions to the broader open source ecosystem, including funding the Linux Foundation's Node.js project. The company learned that extraction without reciprocation damages trust and brand. The playbook is not inevitable; it can be rewritten.

The HashiCorp Model: Business Source License as a Lever

In 2023, HashiCorp moved Terraform from the Mozilla Public License (MPL) to the Business Source License (BSL). The change was explicitly designed to prevent cloud providers from offering Terraform as a managed service without contributing back. Under BSL, the code is free for use, modification, and distribution—but it cannot be used to offer a competing commercial product for a specified period (typically four years).

The reaction was immediate. A group of former HashiCorp employees and community members forked Terraform into OpenTofu, a fully open source alternative under the MPL. The fork gained rapid adoption, splitting the ecosystem. HashiCorp's move protected its revenue but fractured the community. The tradeoff was clear: community trust versus revenue protection.

The HashiCorp model shows that licensing can be a lever, but it is a blunt one. BSL prevents the worst forms of extraction—a cloud provider reselling the project as a service—but it also alienates contributors who value pure open source. The result is a bifurcated ecosystem where two versions of the same tool compete, confusing users and diluting development effort.

Other companies have followed similar paths. Redis Labs switched from AGPL to the Server Side Public License (SSPL), then to the Redis Source Available License (RSAL). Each change sparked forks and community backlash. The pattern is consistent: when a project tries to collect the bill, it risks losing the community that built it. The challenge is to design a license that is precise enough to target corporate extractors without harming individual contributors and small businesses.

Billing the Corporation: Three Proven Strategies

Despite the challenges, several strategies have emerged for maintainers to bill corporations that fork their stacks. The first is the open-core model: offer a free, open source version with limited features, and a paid enterprise version with advanced capabilities. This works well when the project has natural feature tiers—for example, a database that offers clustering only in the paid version. The corporation can fork the free version but will miss the proprietary features that make the product competitive.

The second strategy is selling support contracts tied to usage audits. A maintainer can offer a commercial support package that includes a license to use the project's trademark and access to priority bug fixes. Usage audits—tracking how many instances of the project a corporation runs—allow the maintainer to charge based on scale. This aligns incentives: the corporation pays in proportion to the value it receives. The cost of a maintainer quitting can be built into these contracts as a risk premium.

The third strategy is trademark control. The project name is a valuable asset. By registering the trademark and enforcing it through a foundation, maintainers can require corporations that use the name to pay a licensing fee. This is how the Linux Foundation funds its operations—companies pay for the right to call their product "Linux-compatible." The same model works for smaller projects: the maintainer grants a trademark license only to corporations that contribute financially.

A complementary tactic is publishing a "corporate contributor scorecard"—a public list of companies that use the project and their level of contribution. This applies social pressure. No corporation wants to be seen as a freeloader. The scorecard can be automated using GitHub API data, showing commit counts, issue participation, and sponsorship amounts. Transparency turns reputation into a billing mechanism.

The Maintenance Endowment: A New Governance Mechanism

Beyond licensing and billing, a growing number of projects are adopting governance structures that explicitly fund maintenance. The maintenance endowment model creates a foundation that holds the project's trademark, domain names, and other assets. Corporate fork maintainers are required to contribute to the endowment as a condition of using the trademark. The endowment then funds full-time maintainers, infrastructure, and community events.

This model is inspired by the Linux Foundation's membership tiers, where companies pay based on their revenue and usage. The curl project, led by Daniel Stenberg, uses a similar approach: corporations that rely on curl for commercial products are encouraged to become sponsors. The funds go directly to Stenberg's salary. The arrangement is voluntary but effective—companies that depend on curl understand the value of a maintained project.

NGINX, now under F5, has a commercial entity that funds development. But the community fork, OpenResty, has no such arrangement. A maintenance endowment could bridge the gap: if Cloudflare had contributed to an NGINX foundation, the fork might have been collaborative rather than competitive. The endowment model turns a zero-sum game into a shared investment.

Early adopters of this model include the Rust Foundation, the Node.js Foundation, and the Python Software Foundation. Each requires corporate members to pay annual dues based on employee count or revenue. The funds are used for infrastructure, security audits, and maintainer stipends. The model is scalable: a small project can start with a simple Open Collective or GitHub Sponsors tier, then formalize as it grows.

When the Forker Pays: A Win-Win Blueprint

The ideal outcome is not a legal battle or a community split. It is a negotiated agreement where the forker pays for maintenance, and the original maintainer continues to lead the project. This requires early communication. The moment a maintainer sees a corporate fork, they should reach out to discuss shared maintenance. A transparent cost-per-commit metric—for example, $50 per reviewed pull request—can serve as a baseline for negotiations.

Automation helps. Tools like GitHub Sponsors, Open Collective, and Polar.sh allow maintainers to set up usage-based billing tiers. A corporation running 1,000 instances of a project might pay $1,000 per month. The payment can be automatic, tied to a usage metric reported by the project's telemetry. The corporation gets a predictable cost, and the maintainer gets predictable income.

The Vue.js corporate sponsorship program is a case study. Evan You, Vue's creator, established a tiered sponsorship system where companies pay based on their size and usage. The funds support a core team of maintainers. The program is transparent, with sponsors listed on the website. It has been successful enough to make Vue one of the most well-funded open source projects, with a healthy community and minimal forking.

Not every project can replicate Vue's success. The key variables are the project's strategic importance to corporations, the maintainer's negotiation leverage, and the community's willingness to accept monetization. But the blueprint is clear: negotiate early, automate billing, and make the arrangement transparent. When the forker pays, the fork becomes co-maintained rather than hostile. The receipt is settled, and both sides win.

Yet challenges remain. Some corporations will resist paying, arguing that the license gives them the right to fork without compensation. Others will simply fork and rebrand, avoiding trademark obligations. The open source ecosystem is diverse, and no single strategy works for every project. But the conversation has shifted. Maintainers are no longer silent. They are demanding a seat at the table—and a fair share of the value they create.

Additional Case Studies and Data

To further illustrate the scale of the problem, consider the results of a 2022 survey by the Linux Foundation and the TODO Group, which found that 60% of open source maintainers report feeling burned out, with lack of financial support cited as the primary factor. Among maintainers of projects used by Fortune 500 companies, only 15% receive any corporate funding. The gap between usage and contribution is stark.

Another notable example is the database project CockroachDB, which moved from a permissive license to the BSL in 2019. The company reported that cloud providers were reselling their database as a service without any revenue share. The license change allowed them to negotiate revenue-sharing agreements with major cloud providers, turning a loss into a profitable partnership. The move was controversial but financially necessary.

Similarly, the company behind the popular front-end framework React—Meta—has not faced significant forking issues, partly because they provide the framework for free and monetize through other channels. However, the community has seen forks like Preact and Inferno that compete on performance. These forks are open source and contribute back to the ecosystem, but they also fragment the user base. The lesson is that even well-funded projects can be affected by forks.

On the practical side, maintainers can take specific steps to protect themselves. First, they should register the project name as a trademark early, even if they don't plan to enforce it immediately. Second, they should set up a sponsorship page on GitHub Sponsors or Open Collective and actively promote it in their README and documentation. Third, they should consider adopting a license like the BSL or SSPL if they have the legal resources to manage the transition. Finally, they should build a community that values contribution, so that forks are seen as hostile rather than innovative.

Data from GitHub shows that projects with a clear governance model and a transparent funding mechanism attract 40% more external contributions and have a 50% lower rate of hostile forks. This suggests that proactive measures can reduce the risk of extraction. The key is to act before the fork happens, not after.

Conclusion: A Call to Action

If you are a maintainer reading this, your next step is clear: audit your project's usage. Check your GitHub traffic, your download stats, and your Docker pull counts. Identify the corporations that depend on your code. Reach out to them with a simple proposal: a sponsorship tier or a support contract. Use the strategies outlined above—open-core, support contracts, trademark control, and maintenance endowments—to convert usage into revenue. The conversation has shifted from "should we monetize?" to "how do we monetize?" It's time to send the bill. Don't wait for the fork to become a product. Act now, and turn your receipt into a sustainable income.