Opensource Devtool: how do you monetize without crippling the core?
Working through this problem and would like other founders' actual experience rather than the generic answer. Doberman (open-source runtime guardrails for AI coding agents) is Apache-2.0 and staying that way: the core, the policy engine, the basic detection, the CLI, all of it. That's not up for negotiation. It's a safety tool, and gating the protection itself behind a paywall defeats the point.
Where I'm stuck: what's actually monetizable without making the free version feel deliberately hobbled. Candidates I'm weighing: a hosted dashboard for teams (centralized audit logs, org-wide policy management), premium detection rule packs distributed as plugins on top of the same open core, SSO and RBAC for orgs that need it for compliance reasons anyway. All of those plug in through the same extension points the open core already exposes to community plugin authors, so in theory a premium plugin isn't structurally different from a community one, just maintained and supported by me.
Anyone who's shipped an open-core security or dev-tool product: what actually converted, and what did you try that just made users feel punished for using the free tier?
-
1I’m wrestling with a very similar question in open-source security tooling. The line that makes the most sense to me is: keep the protection itself free, monetize the coordination around it. A solo developer should be able to install the tool, run the core checks and understand the result without paying. Once a team needs centralized policy distribution, audit history, retention, SSO/RBAC, evidence exports, approvals or support/SLA, that feels like a natural paid layer because the value comes from operating the tool across an organization rather than unlocking basic protection. I’d be more careful with premium detection packs. Even if they’re technically just plugins, users may still interpret that as “the good security checks are behind the paywall.” Maybe that changes if the packs are genuinely expensive threat intelligence that requires continuous maintenance, but I’d probably test team controls and compliance/evidence first. A useful sanity check might be: can one developer be fully protected by the free version? If the answer is yes, the open core probably doesn’t feel crippled.8 hours ago Reply
