Opensource Devtool: how do you monetize without crippling the core?
Working through this problem and would like other founders' actual experience rather than the generic answer. Doberman (open-source runtime guardrails for AI coding agents) is Apache-2.0 and staying that way: the core, the policy engine, the basic detection, the CLI, all of it. That's not up for negotiation. It's a safety tool, and gating the protection itself behind a paywall defeats the point.
Where I'm stuck: what's actually monetizable without making the free version feel deliberately hobbled. Candidates I'm weighing: a hosted dashboard for teams (centralized audit logs, org-wide policy management), premium detection rule packs distributed as plugins on top of the same open core, SSO and RBAC for orgs that need it for compliance reasons anyway. All of those plug in through the same extension points the open core already exposes to community plugin authors, so in theory a premium plugin isn't structurally different from a community one, just maintained and supported by me.
Anyone who's shipped an open-core security or dev-tool product: what actually converted, and what did you try that just made users feel punished for using the free tier?
