a github ban over a music app fork got messy fast

so a genuinely unhinged thing happened in the navic discord this week and i had a front row seat, not because i did anything, just because i happened to be in the right dms at the right time.

navic is this navidrome client for android that i love. material 3, gorgeous, exactly my type of app. only issue is it's not the most stable thing in the world and dev has slowed down a lot lately, which happens, maintainers burn out, that's life. anyway one day this guy dan posts in the navic discord about a fork he made called navic plus, built with ai help, that fixed a bunch of the stability stuff and added last.fm insights. i tried it, it was genuinely good, so i opened an issue asking for listenbrainz support too. he added it. turns out dan's also from moldova so we started talking. small world.

i even sent a pr to sonora fixing initial sync time, went from 3 minutes down to under 30 seconds on a big library, so i wasn't exactly anti-navic here, i liked both projects existing at once.

then paige finds out

paige, who maintains navic, sees the fork posted in the discord, deletes the message, and tells dan to rename it and drop anything referencing navic. immediately. navic is gplv3 so legally dan has to comply, and he does, full rebrand to sonora, new name, new package, new logo, the whole thing. paige framed it as just enforcing the license and that's technically true. but the way it went down felt kind of brutal not gonna lie. dan didn't get a "hey can we talk about this," he got a delete and a demand.

fine. that's still a normal amount of drama for open source. forks get renamed all the time. i figured that was the end of it.

it was not the end of it.

dan dms me today saying he got banned. and not banned like kicked-from-a-discord-server banned, i mean banned off github itself. can't star repos, can't watch them, nothing. the repo is still technically up which somehow makes it more confusing, not less, like what exactly triggered the platform ban if the project's still live. i go check the navic server and paige had posted an announcement warning people off "low quality, vibecoded" forks, specifically calling out that sonora was hitting a closed source api that could be logging last.fm credentials or ip addresses without your knowledge.

that's not a "please use the original app instead" post. that's an accusation of quietly harvesting user data. so obviously i forwarded it straight to dan and asked what the hell was going on, and brought it up in the navic server itself too.

the api thing, explained

dan's response was basically: yeah there's an api, and it's for last.fm auth. last.fm requires a secret key alongside the app key, and if you bundle that secret directly into the client apk, literally anyone can rip it out and impersonate the app. so he moved the secret server side, had the client hit his own backend to grab the auth token, standard enough pattern. he didn't just tell me this and expect me to trust him either, he sent me the entire backend source unprompted. i actually read through it. it's an auth proxy. that's it. no logging, no analytics, nothing sketchy hiding in there. just closed source because it's a solo project and open sourcing it genuinely never crossed his mind.

was it the best architecture choice? no, and i told him that directly. he should've just let users drop in their own last.fm api key instead of routing everyone through his server, that's a real design critique and he agreed the second it clicked for him. but "this architecture isn't ideal" and "this is silently logging your credentials" are not the same sentence, and paige jumped straight to the second one, in public, before anyone had actually looked at the code.

to paige's credit, when i pushed on this directly in the navic server, she clarified she wasn't calling it malicious, just that she doesn't trust closed source apis on principle and wanted to warn people. and honestly? that's a fair personal stance to hold. it's just not what the public announcement said. the announcement implied dan was harvesting data. what she actually told me was "i don't trust it and didn't ask questions first." those are very different levels of confidence to be operating at when you're about to torch someone's github account.

where it landed

dan made the repo private, said he's keeping sonora for personal use only from now on, and is actually going to sit down and learn kotlin properly instead of leaning on ai without understanding what it hands him. that's a genuinely good outcome for him honestly, better than most people get out of a public callout. and to be clear, navic's contribute.md straight up says no llm assisted code, so dan building on navic's identity while breaking that exact rule was a real problem, not just vibes. paige gets to be annoyed about that part. that's fair.

but a platform level github ban, over an auth proxy that turned out to be exactly what it claimed to be, for a guy who complied with every single takedown request the second he was asked and handed over his full source without hesitation? that's not proportionate. that's a nuke used on a guy who was already backing down. you don't need to torch someone's github account to make the point that ai generated code needs a human who actually understands it reviewing every line before it ships. especially not when the specific accusation used to justify going that hard doesn't hold up once you actually sit down and read the code, which apparently nobody did before hitting publish on that announcement.

using ai isn't the problem here. shipping code you don't understand is. dan gets that now, the hard way. the ban still feels like it landed on the wrong guy.