Codeberg members voted to reject LLM training on platform data and to restrict vibe-coded projects hosted on the forge.
The German non-profit Codeberg e.V. – which runs the Codeberg code-hosting platform as a GitHub alternative – held its annual assembly this month, where proposals get discussed live before members vote asynchronously over a 14-day window. Two of the motions up for consideration dealt directly with generative AI, and both passed when voting closed.
The first motion commits to a position it’s held informally for some time: the organisation will not use code or data belonging to its users and projects to train generative AI tools.
The association’s statement, quoted directly from the vote, reads: “The Codeberg forge and its associated services are not and will not use the code or data of projects and users to train ‘Artificial Intelligence’ tools such as Large Language Models, whose purpose is to create output modelled after their training input.”
That commitment builds on language already present in Codeberg’s privacy policy, which states the organisation doesn’t want to need user data in the first place. A member vote turns that policy line into an official association position rather than a clause buried in legal documentation.
Codeberg’s members went a step further than the privacy policy already did, declaring the technology incompatible with running free and open-source software responsibly. Some developers will read that as an obvious stance for an open-source non-profit to take. Others will see it as an unnecessary line to draw given how widely LLMs already get used in software development elsewhere.
The second motion proved far more divisive as it changes Codeberg’s terms of use to prohibit what the organisation calls ‘vibe-coded’ projects, referring to software built largely or entirely through LLM-generated code with minimal human authorship or oversight.
Around half of Codeberg’s active members turned out to vote, a rate the association itself flags as high. Members backed the change 358 to 144, with 14 abstentions. Nearly three-quarters of voters supported the restriction, but a bloc of 144 members voting against it shows the policy didn’t land as a settled consensus.
The infrastructure cost of AI crawlers
The blog post ties both votes to a cost problem Codeberg says it’s been dealing with for a while: web crawlers operated by AI companies hammering the platform’s infrastructure to scrape code for training data.
Codeberg already permits open access to hosted code through standard Git operations, cloning a repository requires no special permission. The issue, according to the organisation, is that crawlers ignore that mechanism and instead attempt to load every page on the site individually, including every issue filter variant, full Git history, and file states at every historical commit, even when those files haven’t changed between versions.
That pattern generates database queries the platform wasn’t built to absorb at that volume, and Codeberg says the load has forced its system administrators to spend time building defensive measures rather than working on other infrastructure. The organisation notes those defences – rate limits and access blocks among them – end up degrading service for legitimate users too, since the same mechanisms that slow down aggressive crawlers also constrain normal workflows.
Codeberg’s broader argument is that the true cost of running LLMs doesn’t stop at the companies that build them or the subscribers who pay for access. Higher hardware demand, energy draw, and environmental damage get pushed onto people and infrastructure that never signed up for any of it, Codeberg included, according to the organisation.
Why vibe-coded projects worry a volunteer-run forge
The reasoning behind the vibe-coding restriction gets more speculative, and the organisation is fairly upfront about that. Maintainers say they’ve noticed a recurring shape to some LLM-assisted projects on the platform: a single developer behind the repository, yet the project runs CI/CD pipelines sized for a team, ships release binaries on a frequent and heavy schedule, and claims support across more platforms than its user count would seem to warrant.
Codeberg isn’t arguing that using an LLM to help write code is a problem in itself. The concern is narrower: a developer working alone with an LLM can produce a project that looks, from the outside, like it has a team and a user base behind it, drawing on server resources and storage as if that community actually existed, when what’s really happening is one person prompting a model that converts compute into commits.
Whether that pattern shows up broadly across Codeberg’s hosted repositories, or whether the organisation is generalising from a handful of visible cases, isn’t something the blog post substantiates with data. No repository counts, storage figures, or CI/CD minute totals accompany the claim. That matters because the practical enforcement of a vibe-coding ban depends heavily on how Codeberg’s team defines and detects it, a detail the organisation says it will address separately.
What enforcement means for maintainers
Codeberg acknowledges in the post that it owes the community more detail on how the new terms of use will actually get applied, promising to share thoughts on the practical impact separately from this initial announcement.
That’s a meaningful gap for any organisation or individual maintainer currently hosting a project built substantially through LLM assistance, since the vote establishes a policy without yet establishing the mechanism for identifying violations or the consequences for triggering one.
For anyone evaluating where to host open-source work, or deciding whether internal tooling should route through Codeberg versus alternatives like GitHub or GitLab, the vote signals a platform willing to impose restrictions that other forges haven’t adopted.
GitHub, for comparison, has built Copilot directly into its product and trains on public repository data as a matter of course. Codeberg is now defined by rejecting that model outright rather than treating AI capability as a competitive feature.
The immediate step for any maintainer with an LLM-assisted project on Codeberg is watching for the follow-up post detailing enforcement, since that document will determine what “vibe-coded” means in practice and what happens to projects that fall under the definition.
See also: GitHub Actions abuse turned Packagist repositories into scanners
Want to learn more about cybersecurity from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the AI & Big Data Expo. Click here for more information.
Developer is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.
