Ladybird will stop accepting public pull requests as the open-source browser project prepares for its first alpha release. Future code changes will be introduced only by project maintainers, and the existing public pull-request queue will be closed. The source code will remain publicly available under an open-source licence.
Project leaders frame the decision as a change in responsibility rather than a judgment about whether code was written by a person or an AI system. Every accepted change must fit Ladybird’s architecture, withstand later refactoring and be understood by those who will maintain it. Restricting commit responsibility to maintainers is intended to align authority with long-term ownership.
Security is a central reason. A browser processes untrusted material from across the internet on a user’s device, so a carefully concealed vulnerability can have broad consequences. Ladybird notes that open-source projects have already faced patient campaigns in which attackers establish trust before abusing it. AI tools now make it faster and cheaper to produce a substantial-looking contribution, weakening effort as a signal of a contributor’s intentions.
Historically, outside patches helped projects identify future maintainers. Contributors demonstrated skill and commitment over time, and trust grew from repeated work. Ladybird’s announcement acknowledges that many valuable contributions followed that route and that members of its own team entered open source in similar ways. It argues, however, that a large patch no longer reliably represents the sustained effort it once did.
The policy is intentionally comprehensive. Ladybird will not accept patches through issues, email, comments or repositories as an unofficial alternative queue. External developers can create forks under the licence, but maintainers will not treat them as submissions awaiting upstream review. Closing current pull requests prevents the former pathway from continuing indefinitely during a transition.
Outside participation will continue in forms that do not directly place code into the browser. The project invites reproducible bug reports, website testing, standards and design discussion, security reports and other technical feedback. Those channels can inform work, while a maintainer remains accountable for implementing any resulting change.
The announcement does not say that public contributions caused a known breach or that AI-generated code is necessarily insecure. It describes a changed threat and review economy as Ladybird moves toward real users. The trade-off is clear: the project gives up a conventional route for discovering and onboarding contributors in exchange for a smaller, identifiable group controlling code entry. Whether the policy improves security and maintainability will depend on maintainer capacity, response to outside reports and the project’s ability to grow that trusted group through means other than unsolicited patches.
