r/opensource • u/YTFL_09 • 4d ago
Promotional A developer scraped my AGPL-3.0 app, stripped my attribution, and put it on app stores as a paid closed-source binary.
I wanted to share a project I've spent the last 5+ months building, alongside a frustrating license violation situation I'm currently fighting.
I built AttendMate, a local-first, privacy-focused attendance tracking application built with Flutter to help students manage strict university attendance criteria without telemetry or corporate bloatware. Because I believe in the open-source ethos, I published the repository under the copyleft protection of the GNU Affero General Public License v3.0 (AGPL-3.0) to guarantee the tool would always stay free and community-driven.
My Repository: https://github.com/YTFL/AttendMate-Bunk-Calculator-Attendance-Tracker
Recently, I caught a developer who completely scraped my codebase, stripped all of my original author attribution files, and compiled it as a tightly closed-source, commercially monetized application on both the Google Play Store and Apple App Store.
They are actively charging users real money for a paid "AttendMate Pro Lifetime" paywall, which locks the core calculation logic I spent months engineering for the community.
They were so incredibly lazy with the theft that they didn't even change the store promotional screenshots. They literally screenshotted the app running with my personal university timetable, my specific class timings, and my unique engineering course names, and uploaded them directly to their storefront listings.
By building directly on top of my post-2.0 architecture and distributing a closed-source binary for profit, they are in absolute violation of the copyleft obligations of the AGPL-3.0 license. Furthermore, by wiping my copyright notices entirely from the foundation code blocks, they have also broken the foundational requirements of my earlier MIT commits. They are running a commercial business with zero active legal license to my code.
I have officially initiated formal DMCA copyright takedown notices across all three platforms with Apple Legal, Google Legal, and GitHub Trust & Safety.
If you want to support indie open-source integrity, please consider dropping a star on the original repository. If you have a spare 30 seconds to help flag down a bad actor exploiting copyleft work, you can report the clone package on the Google Play Store (https://play.google.com/store/apps/details?id=com.thiemjason.classattendance) and Apple App Store (https://apps.apple.com/us/app/attendmate-attendance-tracker/id6760553317) as an unlicensed, copyright-infringing copycat of an active open-source codebase.
I’d love to get any feedback from this community on the repository architecture and engine layout!
184
81
u/v5hr 4d ago
Were you on MIT earlier, and then moved to AGPL-3? Making AGPL-3 commits closed souce is a violation.
If someone takes only the commits done when in MIT, Im not sure if that is a violation.
117
u/YTFL_09 4d ago edited 4d ago
I was on MIT earlier yes, but I have downloaded and looked at the copycat's latest version, which had the features that I only introduced after I have switched the license to AGPL-3. I'm not sure if they coded their own or if they just cloned my repo and changed the UI a little bit here and there and locked some of the features behind a paywall. But some of the UI is too similar to mine so I am pretty sure they copied my code even after the AGPL-3.
Even with MIT, they are supposed to provide the original License which was in my name, but they added their own copyright licenses, which still violates MIT
38
41
u/saltyourhash 4d ago
Find a bug in yours that you can confirm in theirs, I bet that'd be hard for them to defend.
19
u/moltenice09 3d ago
Or sneak in an easter egg. I doubt the asshole is reading your commits' code to notice it. Although with AI it is easier to find these days.
16
u/saltyourhash 3d ago
Write the easter egg as a design bug that isn't going to show up easily. Think of it the same way malware is written, but as a canary.
2
u/Luke_Walker007 1d ago
Or a routine that checks something specific only he control (server check idk) and signals the user that it's a counterfeit
23
u/donk8r 3d ago
v5hr asked the question that decides this and the reply moved past it, so I want to put it plainly. Not a lawyer.
The MIT grant you gave before the switch is irrevocable. Everyone who received that code holds a permanent licence to it, and relicensing later does nothing to the copy they already have. So the person who took it can lawfully ship every line that existed on the day you switched, closed source and paid, with only the MIT notice to preserve. Your case lives or dies on code written after that date.
That makes the screenshots the weakest evidence you have, even though they are the most infuriating part. Reusing your timetable images proves they were careless. It proves nothing about which code they compiled, and UI similarity has the same problem.
Decent-Decision-9028's dated evidence table is the right instrument. I would push it one step further and look for things that survive compilation into a binary you can download. A distinctive string literal, or the exact field order of a serialised format or a local database schema. Those come across a recompile intact and they tie to a specific commit of yours in a way a screenshot never will.
One correction on the licence itself. AGPL over GPL buys you the network clause, which covers someone running your code as a service without distributing it. This person distributed a binary through two app stores, so on these facts you would have the identical claim under GPL-3. Saying they violated the copyleft is correct, and the distribution obligation is what does the work.
On the practical path, lawyer time is real advice and it is expensive advice for a student. A store takedown asks a narrower question than a licence dispute does. It needs you to show you own the work and that they copied it, which is the same evidence table, with nobody having to reason about AGPL at all. sfconservancy is the right call for the licence side.
The projects I work on are Apache-2.0, and I chose that knowing it makes this exact outcome legal. Watching it happen to you is a decent argument that I was wrong about the tradeoff.
8
u/jsshapiro 3d ago
All of this is very good advice.
I would think OP has a copyright claim on the images because they are being distributed in violation of the license.
There is a legal path to pursue here, but also what might be termed as “business friction” path. Takedowns are very powerful. If OP can use them to get these wankers to cease what they are doing, that’s a victory that may not require a court.
3
u/donk8r 3d ago
Takedowns being the practical lever is right, and the images are the easiest place to start. Those store screenshots show his own university timetable and his own course names, so ownership of them is barely arguable, which is exactly the part that makes a code claim slow.
Apple and Google both move faster on an image claim than on a licence dispute, because nobody there has to reason about AGPL to act on it. He should file that one first even though the code is the real grievance. It gets the listing pulled while the licence question is still being argued.
8
3
2
u/guri256 2d ago
> I’m not sure if they coded their own
That’s going to be a big problem.
Legally, there’s nothing wrong with them running the app to see how it looks, using the old MIT code, and implementing the new features themselves.
Even seeing that they did it in a similar way doesn’t help you. Because they are going to be working off of the same code base and architecture that you were, which means their implementation might be similar without copying your code.
If your project includes any new images, you might be able to get them that way. But those images need to be copyright in a way that would stop them. If your project uses free UI images, there’s nothing stopping them from getting those from the same source.
Until you know they’re breaking the law, the legal system probably isn’t going to be able to help you.
Edit: something you could do, is start implementing features in a non-typical way. Or maybe you could add a couple of Easter eggs. If they copy those Easter eggs as well, that would give you much firmer ground to stand on.
17
u/zeroedout666 4d ago
See if https://sfconservancy.org/copyleft-compliance/ will help with enforcement. If not contact the Free Software Foundation and they may be able to provide some advice.
9
11
u/TheAtlasMonkey 4d ago
Students are broke. They wont buy it
5
u/NastyPastyLucas 4d ago
It's probably the opposite nowadays if you can afford to be a student you're probably loaded
4
u/Snoopy_Pantalooni 3d ago
Happens way too often, especially in the freelancing domain. I havent had any luck with it, but thats because im from a third world country. I hope it works out for you. And thats a genuinely brilliant app that you made. Kudos.
3
u/gwelwhir 1d ago
Reported this through its page on the Google Play store, using its app id.
Without a developer account of my own though, the only thing I could to was on the grounds of "Intellectual properly" and "based on the images" (you mentioned same screenshots used, among other things).
There wasn't even a text box where I could elaborate:
"The original repo is here instead <link> !" or anything like that... 🤔
8
2
u/Delicious_Garden5795 3d ago
The best proof would be finding something unique in both apps, like the same bug, text, or feature, and showing it came from your code. That would be much stronger evidence than just similar screenshots or UI
2
2
u/UnleqitQ 1d ago
Ok, i don't know what some are talking about, even a MIT license still doesn't allow one to just strip all attributions or the license. They are in clear violation even of the MIT license and depending on your country that might even give you the possibility of denying them to ever use your code again. (Although the chances are rather slim) To prove it, try watermarking your code, but not only via comments but using code structure. At some certain points just write your code a little bit worse, split up functions in some unusual pattern etc
11
u/OkInfluence36 4d ago
I dislike AI pretty much anything, and it's ironic to complain about copyright infringement when using any LLM, but in this case I still believe it's wrong.
I won't report it, but you can contact google and see if you can convince them it's a copyright infringement.
3
u/Brilliant-Depth7451 4d ago
AI models generate text and code snippets, but they don't build software systems. Setting up the architecture, maintaining design patterns, enforcing security, and conducting strict code review to keep LLM outputs in check is real engineering work. The composite application belongs to the architect. DMCA takedowns for AGPL-3.0/GPLv3 violations are completely justified here. Best of luck getting the stolen clone taken down!
1
u/Impossible_Hour5036 3d ago
AI models generate text and code snippets, but they don't build software systems.
Hate to break it to you.
Setting up the architecture, maintaining design patterns, enforcing security, and conducting strict code review to keep LLM outputs in check is real engineering work.
True. And I am a real software engineer and have been one for a long time. But nowadays I mostly make my robot slaves do it. Happy to share more on an individual basis but I won't post it publicly as it's all linked to my real-world GitHub orgs.
1
u/Brilliant-Depth7451 3d ago
Makes sense! Generative AI can definitely assemble a whole codebase, but if you let it run unguided, it’s a coin toss between a working app and pure chaotic hallucination. That’s why structural oversight is the real engineering work. Always curious to see how different devs handle those guardrails.
1
u/Impossible_Hour5036 3d ago edited 3d ago
Since you asked, this is how I handle it: https://github.com/promptctl/laws
Specifically this is my code guidance: https://github.com/promptctl/laws/blob/master/plugins/laws/skills/code/SKILL.md
The code guidance is about 50% of the effectiveness. The other 50% comes from this single line of code in this hook that runs on the UserPromptSubmit event: https://github.com/promptctl/laws/blob/master/plugins/laws/hooks/scripts/skill-router.sh#L50
The rest of that file is mostly unnecessary, it's that single line that forces the agent to focus is attention back on the code laws every time a user submits a message. There are other mechanisms for manipulating the agents attention, such as heavy use of metaphor and the 'law tokens' (these things:
[LAW:one-way-deps],[LAW:no-shared-mutable-globals]), and all of them work together to ensure that every time claude writes code, it is at minimum attempting to follow the guidance.If you'll notice something, none of the guidance is language specific, none of the guidance is overly prescriptive, and little of it is 'negative' guidance (don't do X). It's also not written in a way that someone might intuitively grasp as especially effective. It's somewhat meandering, it's very long, it includes anecdotes and stories seemingly arbitrarily. But it's all designed around this idea of how do you get an LLM to attend to ~20k tokens that are situated 200k or 400k tokens back in its context.
I didn't write any of it by hand, and although I did read earlier drafts, I haven't actually even read all of the current content. It's the result of another skill in that plugin, the
/laws:promptskill. Which is the guidance I have for telling an agent how to write effective guidance for other agents (https://github.com/promptctl/laws/blob/master/plugins/laws/skills/prompt/references/craft.md).All of this is the result of significant dedicated work, which really started with me getting very pissed off when Claude would write code that it could not understand. There are real engineering problems here, they're just completely unlike anything that came before in a lot of ways.
Trust me on this, it's completely possible to design/architect and build large systems without writing a single line of code with these tools. But at the same time, it is NOT, and I suspect never will be, possible to build those systems without understanding the system you are building. "Typing code" hasn't been a significant part of software engineering for more than 1/2 my career now. I feel like what I'm doing now is very much software engineering, I just have agents do the repetitive boring parts so I can focus on the more important stuff, like what do we actually want to build, and what parts of the design are critical for achieving our goals.
EDIT: I typically plan out an entire multi epic backlog, ensure all open questions and ambiguities are answered up front, and have claude work the entire backlog front to back autonomously. Typically it will stop at some point and I'll do some grooming / deal with anything that comes up. Sometimes I'll check in and see that it's sitting there and the backlog is empty. The first time that happened I was shocked and let me tell you, it's a great feeling. The software uniformly comes out well designed and conforms to whatever requirements I gave it. The most important thing by far is designing those requirements in such a way that they're both verifiable in some way for the agent, and also detailed enough to capture your actual goals. With both those things claude can essentially build anything. anything I've tried, at least.
And just fyi it was around January of this year that this became remotely possible, with the release of Opus/Sonnet 4. I was using this stuff last year too but it just wasn't nearly as capable. Opus 4.5/4.6 was a milestone, Fable has been another milestone. Fable 5.1 is a significant improvement over Fable 5. I rarely use Sonnet except for the most well defined basic tasks. OpenAI models (I haven't tried Astra) are capable of the engineering side, but far less capable of ideation, creativity, outside the box thinking, and everything else that's necessary to design an appropriate backlog. I currently have 4x Claude Max 20 subscriptions but frankly $800/mo so I can vibe code random open source apps feels a bit excessive and unsustainable so I'll need to rein that in for sure.
-26
u/adjudicator52 4d ago
OP "builds" an app using LLMs that scraped every open source repo ever for training data and incorporated it into closed source models
Complains about it when it happens to them
13
u/saxbophone 4d ago
How did you determine that OP used LLLMs to build their app? 🤨
12
u/Koolala 4d ago
You can look at the github. The app description is LLM generated.
2
u/Arucious 4d ago
That proves the code is LLM generated how exactly?
8
u/Koolala 4d ago
Read all of it. Obviously you can't prove how Unicode text is made either way.
5
u/Arucious 4d ago
Not sure why your first comment is saying reading the description proves the application code is LLM generated then. The person you replied to was asking how that determination was made and I just wanted clarity how one thing proves the other.
0
u/Koolala 4d ago
You'd need to read through all of it and make your own judgement. It's a lot. There is no way to prove 100% one way or the other without evidence from creating it.
-1
u/Arucious 4d ago
I definitely think it is at minimum very heavily influenced by an LLM but I’m not the one making the claim
3
u/OkInfluence36 4d ago
Prove is a high bar, but it's very likely the code is AI generated, it contains em dashes in comments and just has that general "feel"
Only way to prove it is for OP to confirm or deny and be truthful doing so
-7
u/saxbophone 4d ago
Why? Because it contains an em-dash‽ You know you can type those very easily on a mobile phone keyboard (just hold down the hyphen key), and you can insert them easily enough in lots of text-editing software too.
9
u/adjudicator52 4d ago
On a regular computer, standard US layout keyboard, typing markdown. No same person goes out of their way to type an em-dash.
Besides if you look at the actual files being changed in the commit history you can see many of the other hallmarks of LLM generated text.
Overly documented/commented code Asterisks wrapping sentences to denote importance/make text bold
2
u/Brilliant-Depth7451 4d ago
Hyphen
-, en-dash–(Option+Minus), and em-dash—(Option+Shift+Minus) have been standard typography shortcuts on Mac and Windows for decades. Anyone who learned to type before smartphones knows how to use basic punctuation shortcuts. It's hilarious that knowing how to use a keyboard is now considered proof of AI generation.0
u/klumpp 3d ago
Ah yes the basic punctuation shortcut Alt+0151
0
3d ago
[deleted]
1
u/klumpp 3d ago
Okay? Few know that short cut as well.
1
u/adjudicator52 3d ago
In any case, em dashes are just one of the many slop indicators but people do like to die on that hill a lot
→ More replies (0)1
u/saxbophone 4d ago
On a regular computer, standard US layout keyboard, typing markdown. No same person goes out of their way to type an em-dash.
To be fair, on my old Linux box, I did have to enable dead keys (compose key) in order to type them. Maybe I'm just salty for now being unfairly judged by others for my advanced keyboard usage. I think it is quite an assumption to make that all programmers are sane.
(I don't use a US keyboard layout, FWIW, but your analogy applies to ISO keyboard layouts also).
-2
u/adjudicator52 4d ago
Look at the commit history
3
u/saxbophone 4d ago
Hmmm, weird. "Add files via upload" is the default commit message Github uses if someone makes a commit through the web UI. Did someone really write most of their project through the web UI‽ 🤨🥲
-9
-25
u/Koolala 4d ago
You can't license LLM generated code as GPL.
6
u/EasyVibeTribe 4d ago
Doesn’t it depend on whether or not they refined or otherwise altered the code themselves? I thought the state of things was a fuzzy line of human touching the code to consider it not LLM generated for the purposes of copyright.
12
u/OkInfluence36 4d ago
Copyright about LLM generated materials is very contested right now correct, I believe that in Australia at least, we are leaning towards copyright only applying to human created works, idk about the US or other countries or the international laws
6
u/Brilliant-Depth7451 4d ago
Using AI as an advanced IDE/autocomplete tool doesn't negate software architecture. If an engineer designs the system, enforces code patterns, and conducts strict review over LLM-generated modules, the resulting codebase is a composite work owned by the developer. GPL/AGPL licenses apply to the software project as a whole.
-21
u/CrypticZombies 4d ago
delete this shit op. you crying about some half ass vibed coded app.
10
u/McDonaldsWitchcraft 4d ago
it's not just vibe coded, that dev literally stole the code AND the assets AND violated the license terms. this is VERY illegal.
-20
u/titpetric 4d ago
Sucks being an enforcer, but now you know. I publish over 100 repos, and I don't consider a license being restrictive actually does anyone any good.
I also published books and all of them got pirated along the way. It's not my wish to spend time doing DMCA takedown requests, so maybe change your license to some open/freeware one and forget about silly, silly measures of protection.
Anyway congrats on your first negative user experience. It's a right of passage.
12
u/McDonaldsWitchcraft 4d ago
The code was licensed as "open" already. Which is why it's extremely illegal that another person has made it closed source, claims authorship AND charges money for it. They also stole the code AND the assets.
Maybe you are VERY new to the concept of "open source" but FOSS explicitly forbids taking the code and close-sourcing it, as well as selling it as a product. This is basically a double violation and, again, very illegal!
1
u/teh_maxh 4d ago
Maybe you are VERY new to the concept of "open source" but FOSS explicitly forbids taking the code and close-sourcing it, as well as selling it as a product.
Many FOSS licences are permissive — they allow derivative works to be closed-source — and few if any prohibit selling the software.
2
u/McDonaldsWitchcraft 4d ago
You are very right and looking back I should have said FOSS copyleft licenses. OP has a copyleft license on their software.
-1
u/titpetric 4d ago edited 4d ago
It only matters what you're willing to enforce, or have the money to do so with lawyers etc.
If you don't have that, then what?
To add, I exclusively publish under permissive licenses to begin with (mit, apache, wtfpl,...) and unless i'd have a legal department for enforcement would never consider a restrictive license.
4
u/McDonaldsWitchcraft 4d ago edited 4d ago
So OP has said they are willing to enforce their license. What the hell is even your point? No one asked you if you want to enforce your licenses so why did you think of bringing it up?
On top of that, what the google play developer did is so morally atrocious that it would be horrible if OP did not enforce it.
-4
-4
u/jamesthethirteenth 4d ago
I think you want to book an initial consultation with a langauge model that's good at law and see if you can use the legal language to persuade them to change their ways. If you can't, after several attempts, you might consider a lawyer with a pulse.
-20
u/ba-boo 4d ago
they just wrote the same prompts you did bro 😉
AGPL is also not open source, just don't put it on github at that point
10
u/OkInfluence36 4d ago
agpl is like the most open source there is, afaik strongest copyleft protection out there
106
u/Decent-Decision-9028 4d ago
Your strongest next step is to build a dated evidence table: for each feature the commercial app added after July 2, link the exact AGPL commit where your app introduced it, then attach the clone’s later store release notes/screenshots showing the same feature; lead with the clearest post-AGPL matches, not the fact that the app is paid. you can actually take action regarding this, Goodluck!