Can you license code and pull request history to AI companies?
A repository saves more than the code. Every change arrives with a message saying why, and many arrive as a pull request that a teammate reviews and argues with. The reviews, the failed fixes and the tests that finally passed are a recording of how engineers work. That history, more than the latest snapshot, is what makes a private codebase interesting.
What a repository contains
| Commits with their messages | A saved change with the author’s note on why it was made. The note is a ready-made explanation of the change beside it. |
| Pull requests and review discussion | The proposed change and the comments that asked for something different. Often where a senior engineer explains what is wrong. |
| Issues and tickets linked to the change | The bug report or request that started the work, so a problem can be followed to its fix. |
| Tests and build configuration | The checks that decided whether a change was good, and the history of how they evolved. |
| Design notes and postmortems | The write-ups kept in the same tools, which explain a decision after the fact. |
History beats a snapshot
Public code is easy to find. What is not easy to find is a private codebase with years of change behind it, written by a team, with reviews attached. The path from a failed first try to a working fix is the scarce part.
Research on commit history has shown that pairing a change with its message produces useful training examples. The point for an owner is that a repository kept carefully for years is already organized the right way.
Ownership, secrets and open source
Employees usually write code under an agreement that assigns it to the company. Contractors are not automatic, so check each agreement. Code written for a client often belongs to the client, and open-source components keep their own licenses.
Old commits can hold passwords and keys that someone saved by mistake and later deleted from the current code but not from the history. They must be found and removed, and the keys should be replaced anyway.
What comes out of the history first
| Secrets, keys and credentials | Found in the full history and removed. The keys are replaced by the engineering team in any case. |
| Code the company does not own | Client work, forks of open-source projects and third-party code are excluded. |
| Personal data in test fixtures and logs | Customer records that crept into tests or example files are removed. |
An example, invented for illustration
A software company with a dozen engineers keeps its product in private repositories on a hosted service, with pull requests and linked tickets going back several years. A set includes the repositories the company owns outright, scans the whole history for keys and personal data, and replaces author names with stand-ins. Contractor-written modules without an assignment are left out until it is signed, and the owner approves a sample before anything is exported.
Questions owners ask about this
Is the current code enough, or does the history matter?
The history is much of the value. A snapshot shows what the code is now, and the history shows how it got there and what was tried first.
We use a lot of open-source libraries. Is that a problem?
Only for the libraries themselves. They keep their own licenses and are not part of what you own, so a set covers your code and leaves theirs out.
Could the code be copied by the AI company?
What is allowed is set by the terms: who may use it, for what, and whether it may be reproduced. The owner approves what is included, and nothing is promised in advance.
Didn't find your question? Ask us directly.
Keep reading
Related kinds of records
- Team chat: Slack and Teams threads, where one person must stay one person and direct messages stay out.
- Project and task history: Jira, Asana, Linear, Monday, Trello, ClickUp and Airtable comments and status changes, not task titles.
- Jira data export: How to get issues with their comments and links out of Jira, and the secrets to remove first.
- GitHub repository export: How to take code, pull requests and review comments out of GitHub, and the keys to remove first.
Industries that keep these records
- Software companies: Tickets, postmortems and renewal threads; customers appear everywhere and code is a separate deal.