Their contribution agreement forces you to give up copyright to them.

The license just looks like the standard Apache license though, which doesn't require this. With the Apache license, contributors still own the copyright to their code, but they license it to the project. Did you see a document in the repo that says something different?

For posterity because I didn’t explain why/how it’s sketchy:

• they just found a hardcoded key that skips all security that was in the wild for like two years
• significant vibe coding means nobody actually understands the codebase. Hence not finding the backdoor key
• some of the documentation is only in Chinese, which isn’t sketchy in itself, but given the backdoor key does seem fucking sketchy.
• they have an X link you cannot remove from the admin console
• the admin console has minor but stupid bugs: you can’t go from a bucket to the list of buckets, auth is janky, etc.

Just because it’s good a good name doesn’t make it good pedigree (which is a bone I have with rustXYZ named projects). The fact nobody caught serious backdoors for years is damning.

If you’re running this offline, it might be fine for you. I still run it inside my vpn behind auth but I’m looking to move off.