The month an AGPL license letter demanded my source code at 56K MRR

The letter came from a law firm I had never heard of, on behalf of a copyright holder whose name I recognised only because it was sitting in our lockfile. We were at $56,000 MRR, fourteen months past a commit nobody had thought about since. The first thing I did was confirm that yes, we had modified an AGPL licensed library and were running it behind a network service. The second was calculate what publishing our entire codebase would do to the company. The third, three days later than it should have been, was read the license, at which point the demand shrank by a factor of several hundred and the letter turned out to be the most useful thing anybody sent me that year.

Quick answer (2026): This is a composite diary, not one real company, though every clause, section number, quoted passage and calculation in it is real and linked below. We had forked an AGPL-3.0 library to fix a font bug and shipped it server side for fourteen months. The demand was for the complete source of a 148,000 line platform. Section 13 asks for the Corresponding Source of "your version" of the modified program, which here was a 24,000 line public library plus our own 190 lines, a scope roughly 779 times smaller. Section 8 mattered more: our rights had terminated automatically fourteen months earlier, and the letter was what made permanent reinstatement available, because that path requires a first notice from that holder and a cure within 30 days. Quietly fixing it unnoticed would have bought only provisional reinstatement, revocable at any time. I am not a lawyer, whether a given combination counts as a modified version is genuinely contested, and none of this is advice.

The dependency I forked and forgot

Fourteen months earlier an engineer had hit a font embedding bug in the library we used to render PDF exports. The upstream fix was open and unmerged. He pulled the library into our monorepo, applied a 190 line patch across three files, and moved on. It worked. Nobody wrote it down anywhere except the commit message, which said "fix pdf fonts". Our dependency manifest still listed the upstream package, because we had vendored the fork rather than published it, and every license scan we had ever run read the manifest.

That is the whole mechanism, and it is worth saying plainly because it is not a story about ignoring a license. It is a story about a license scanner reading a file that had stopped being true. The fork was invisible to the tool precisely because forking it is what made it matter.

In those fourteen months our MRR went from $31,000 to $56,000. On a straight ramp that is $609,000 collected while, as I would learn on day three, we had no license at all.

What the letter asked for

The demand had two parts. Publish the complete corresponding source of the platform under the AGPL, or stop using the library entirely, in either case within thirty days. There was no dollar figure, which I first read as restraint and later understood as leverage: the absence of a number let me supply my own, and the number I supplied was the entire enterprise value of the company.

Our platform is about 148,000 lines. Publishing it was not a remediation plan, it was a liquidation. So I priced ripping the library out instead, and the honest engineering estimate came back at six weeks. Six weeks is 42 days. The window was 30. That arithmetic is why I finally read the actual text rather than the summaries, and the two say materially different things.

What section 13 actually says

The network clause everybody quotes is section 13 of the GNU Affero General Public License version 3, and its operative sentence begins with a condition rather than a consequence: "Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version."

Three things in that sentence are doing work that the summaries drop.

The trigger is modification, not network use. We had modified it, so we were squarely inside the clause and this got us out of nothing. But the widely repeated shorthand, that any AGPL dependency behind a network service forces disclosure, is not what the sentence says.

The object is "the Corresponding Source of your version". Not of your product. Your version of the Program.

And Corresponding Source is a defined term, defined back in section 1, which closes with a sentence almost nobody quotes: "The Corresponding Source for a work in source code form is that same work." The library ships as source. Our fork of it is source. So the Corresponding Source of our version of the library is our version of the library.

The deliverable was the fork. A 24,000 line library that its author had already published, plus our 190 lines. The letter asked for 148,000 lines. The license asked for 190 that were genuinely ours. That is the 779x gap, and it is the difference between a remediation and a liquidation.

The clause that made the letter good news

Section 8 is titled Termination and the first thing it does is tell you that you are already in trouble. Rights under the license terminate automatically on violation. Not on notice, not on suit. Our license had terminated fourteen months earlier, on the afternoon that patch shipped, and every day since had been unlicensed use. Nothing about the letter caused that.

What the letter caused is in the two paragraphs directly underneath, and reading them in order inverted my whole understanding of the position.

The first says that if you cease all violation, your license is reinstated "(a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation."

The second begins with the word "Moreover", and it is the one that decided what we did: your license "is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice."

Read those together and the counterintuitive thing falls out. If we had noticed the fork ourselves, quietly published it and never heard from anybody, we would have been in path (a): provisionally reinstated, revocable by that holder at any time, and only hardening into permanent reinstatement after 60 silent days. Because they wrote to us, and because it was the first notice we had ever received from that holder for any work, curing inside 30 days converted the position straight to permanent. The letter was not the thing that put us at risk. It was the fastest available route out of a risk we had been carrying, unknowingly, for over a year.

It is also a one time instrument. That clause spends itself on first notice, and the phrase "for any work" means it is spent against that holder across everything they own, not just the library we had touched. It was worth more than winning the argument about scope, and more than the six week rewrite, which could not fit inside the window anyway.

We published the fork on day six.

The number nobody quotes

With the cure in, I went back to work out what the exposure had actually been. Every advisory page I could find gestures at a $150,000 ceiling. That figure is real and it sits in 17 U.S. Code section 504, which sets statutory damages at "not less than $750 or more than $30,000 as the court considers just", raised to "not more than $150,000" where infringement is proved willful.

Three things sit next to it that I had never seen quoted anywhere.

The same subsection says "all the parts of a compilation or derivative work constitute one work". A demand that multiplies a per work figure by files, copies or customers is not reading the statute. It is one work.

The same subsection lets a court "reduce the award of statutory damages to a sum of not less than $200" where the infringer "was not aware and had no reason to believe" the acts were infringing. There is a floor as well as a ceiling.

And 17 U.S. Code section 412 conditions the whole apparatus. It provides that "no award of statutory damages or of attorney's fees" shall be made for "any infringement of copyright commenced after first publication of the work and before the effective date of its registration, unless such registration is made within three months after the first publication of the work". Statutory damages and attorney's fees both. For an unregistered work, the ceiling that the entire advisory internet anchors on is not available, and neither is the fee shifting that is what actually makes a demand letter frightening to a company our size. What remains is section 504(b): actual damages plus the infringer's profits attributable to the infringement.

So I did that arithmetic. Of the $609,000 collected in the window, accounts that had ever generated a single PDF represented 22 percent, or $133,980. At our 19 percent net margin over that period, the profit attributable to the feature the library sat behind was about $25,456. Not $609,000, and not $150,000: roughly 24 times smaller than the number I had frightened myself with, and an argument about attribution rather than a cliff.

Being careful here: that is me reading statutory text, not a decided case about our facts. I checked the Copyright Office record for the library and found no registration, which is a fact about one library and not a general rule. Plenty of open source projects are registered. Ours was not.

Why I am still removing it

None of the above is a reason to keep the dependency, and this is the part I most wanted someone to tell me on day one. The license text and the market do not agree, and the market is not obliged to. Google's published open source policy states that AGPL code "MUST NOT be used at Google", and it is explicit that its trigger is broader than the license: the viral effect, it says, "is triggered if the product or service can be accessed over a remote network interface, so it does not even require that the product or service is actually distributed". It then says the ban is deliberately "aggressively-broad" to doubly ensure the situation never arises.

That is a policy, not a reading of section 13. But you do not get to argue section 13 with a procurement team. What they run is a scan, and what it emits is an SPDX identifier, and the identifier AGPL-3.0-only appearing in a software bill of materials is sufficient on its own to fail a policy like that one. Our two largest prospects at the time both required an SBOM. Neither of them would have read the license.

So we shipped the replacement on day 44, with the permanent reinstatement banked and nobody standing over us. That is the correct order and it took me too long to see: cure first, because the clock is real and short, then remediate, once it has stopped.

What actually happened

Revenue in the unlicensed window: $609,000. Share from accounts that ever used the export: $133,980. Profit attributable at a 19 percent margin: about $25,456. Paid: nothing, because the cure was made inside the window and the demand did not survive it.

The one thing I would tell you

The instinct when a letter like that lands is to negotiate, and the instinct is wrong, because the only asset you are holding is time and negotiating spends it. Section 8 gives you exactly one first notice from any given copyright holder, and it converts into permanent reinstatement only if you cure within 30 days of receiving it. It does not care whether you were right about scope. It does not care whether the demand was reasonable. It cares whether you stopped.

The cure that fits inside 30 days is almost never the one the letter asks for, and it is almost always smaller than you think, because the license defines its own deliverable and the letter does not. Read the definition before you read the demand. Then cure, cheaply and immediately, and do the expensive right thing afterwards on your own schedule, when the clock has stopped and the leverage has gone.

I had been out of license for fourteen months and did not know. The letter that told me was the only reason I was ever able to get properly back in.