Cockroach Labs exists to solve some of the hardest problems in data infrastructure. Our customers rely on us to deliver a database that survives outages, scales globally, and evolves fast enough to meet requirements that change in unpredictable ways. That mission drives every decision we make, including how we manage and distribute our source code. From the beginning, CockroachDB was released as an open-source project. In 2019, we transitioned to the Business Source License, and in 2024, we evolved our licensing model further to consolidate around the CockroachDB Software License. Through each of those changes, we maintained our commitment to keeping CockroachDB's source code publicly available, commonly referred to as "source available." We believed then, and still believe, that transparency in how software is built fosters trust and helps the broader ecosystem.
Why we're making this change
However, publicly available source code now carries risks that did not exist even two years ago. Security is at the top of that list.
AI has transformed the way code is consumed, analyzed, and reproduced. Large language models can surface implementation details, internal logic, and architectural patterns at a scale and speed that fundamentally changes the security calculus of source availability. Attack surfaces that once required deep manual analysis to find can now be identified rapidly and at scale. Vulnerabilities in publicly visible code can be discovered and exploited faster than fixes can be deployed. We saw this play out firsthand with Mythos: keeping our source publicly available while defending against AI-assisted analysis means fighting with one hand tied behind our backs.
Beyond security, the legal frameworks that have historically protected source code, particularly copyright, are entering genuinely uncertain territory as AI becomes central to how code is written and derived. Publicly available codebases can now be monitored and functionally reproduced at a scale that was not feasible before. These are not theoretical concerns. We are already seeing early real-world examples of AI being used to produce functional reproductions of protected software, and the trend is accelerating.
What is changing
These dynamics have led us to a straightforward decision: going forward, new versions of CockroachDB's source code will no longer be published to our public repository. This also applies to Pebble, our high-performance storage engine, which will similarly move to private development.
To be clear: our license terms are not changing. CockroachDB continues to be licensed under the CockroachDB Software License. What is changing is that new releases will no longer have their source code publicly visible.
The existing open-source repository is not going anywhere, however, we will no longer maintain or update it, but it remains available as-is.
What this means for customers
Our ability to innovate quickly on behalf of the businesses that depend on CockroachDB requires that we protect the intellectual property behind that innovation. As the security and legal protections around publicly available source code erode, continuing to publish our core IP introduces risk to our business and to the customers who rely on us to keep advancing the product.
We know that some customers and community members have relied on our public source code for workflows like understanding CockroachDB internals, filing issues, or referencing implementation details. We have prepared a detailed FAQ that addresses how these workflows will be supported going forward. If you have questions that aren't covered there, please reach out to your account team or our support channels.
Our continued investment in open source
We recognize that this decision sits within a broader conversation about the role of open source in an AI-driven world. We want to be direct: we still believe in open source. But we also believe that open source is most effective when applied thoughtfully, and that not every codebase carries the same risk profile. A general-purpose Go library and a proprietary distributed database represent fundamentally different security and IP considerations, and we think it's reasonable to treat them differently.
We continue to actively maintain a number of open-source Go libraries that are widely used beyond CockroachDB, including errors, apd, redact, datadriven, and others. We also contribute upstream to projects we depend on, including Go itself, gRPC, and the Bazel ecosystem.
We will continue to share the ideas and innovations behind CockroachDB through our blog, technical white papers, conference talks, and the many other ways we've always engaged with the community.
We are making this change because we believe it is the right decision for our customers, our business, and the long-term health of the product. Our commitment to our community, our partners, and our customers remains the same. Thank you for the trust you've placed in us and in CockroachDB.
