Selling code to AI: licensing source code, tickets and engineering history

Why do AI buyers want code with its history?

Because AI developers are training models to do software work, and a finished repository does not show how it was built. The history does: why a change was made, what a reviewer objected to, and which ticket it fixed.

Turing says plainly that "code earns most with its history: commits, pull requests and reviews, tickets and docs", and that communication and tickets "often matter more" than code¹. Ventra seeks "source code with its history, reviews and the decisions behind it"⁹. Labelbox Prism marks software and internet data as "urgent" and wants code edit traces with "diffs, test results, review comments"⁸. Mercor connects to GitHub for "repositories, commits, PRs, and issues"¹¹.

SimpleClosure's chief executive puts it well: "A feature traced from a Notion spec through Figma designs and Jira tickets to the finished GitHub code tells a fuller story than the repository alone"⁴. The most valuable package links your repositories, issue tracker, pull request reviews, design documents and incident or support threads. More on demand across all record types is in what AI companies buy.

Do you own all of your code?

Probably not all of it. Code written by employees in the course of their work usually belongs to the company; code written by contractors, agencies and freelancers usually belongs to them unless they signed it over.

UK copyright law treats a computer program as a literary work¹⁵. The author is the first owner, except that the employer owns work an employee makes "in the course of his employment", "subject to any agreement to the contrary"¹³. An assignment "is not effective unless it is in writing signed by or on behalf of the assignor"¹⁴.

Check three groups before you license anything:

• Contractors, agencies and offshore teams. Find the signed assignment clause for each. If it is missing, ask for a confirmatory assignment.
• Founders' early code, written before the company existed or before their employment contracts began.
• Bespoke work for clients. Many development contracts assign the code to the client or restrict its use. Leave client repositories out unless the contract clearly lets you license them.

SimpleClosure warns sellers to check for "confidential or third-party material you may not have the right to transfer"⁴. A buyer will ask you to warrant ownership, so this work protects you as well as them.

How do open source licences and third-party code affect licensing?

You can only license what you own. Open source libraries and vendored third-party code belong to their authors and come with conditions, so most sellers should leave them out and license their own first-party code.

Common licences attach different conditions to passing code on:

The GPL defines "convey" as any propagation "that enables other parties to make or receive copies"¹⁶. Handing a buyer a copy of GPL code may therefore carry the GPL's conditions with it, which sits badly with an exclusive licence. Take legal advice if your repositories include GPL code.

In practice: run a dependency and licence scan, exclude vendored folders, list any third-party components and their licences in the data manifest, and limit your warranties in the licence to first-party code. Our licence terms guide covers warranties and exclusivity.

What about customer data in tickets, logs and databases?

Treat your product database and anything customers uploaded as off limits. For most software companies that data belongs to customers, and you may use it only on their instructions.

Under UK GDPR a processor "processes the personal data only on documented instructions from the controller", and a processor that decides the purposes of processing itself "shall be considered to be a controller" for it¹⁹. Licensing customers' data to an AI buyer would be exactly that, and would almost certainly breach your customer contracts too.

Customer data also leaks into engineering records:

• support tickets and bug reports with names, emails, screenshots and attachments;
• application logs with user IDs and IP addresses;
• test fixtures and seed files copied from production;
• pull request discussions that paste real records.

These need removing or masking, to the standard in our anonymisation guide. We prefer that done before anything leaves your systems: Scale AI says it anonymises "inside your environment, before any data is extracted"⁷, and SimpleClosure processes every dataset "for PII before it is licensed"⁵. Where a buyer removes personal data after transfer, we tell you in writing first and your own solicitor confirms the transfer route.

Which secrets and security checks come before any transfer?

Revoke or rotate every credential that has ever been committed, then scan the whole history. Deleting a secret from the latest version leaves it in every earlier commit.

SimpleClosure warns that "live credentials such as API keys and access tokens" can be "buried in code, tickets, and attachments"⁴. GitHub's secret scanning "scans your entire Git history on all branches"²¹, and GitHub's guidance says that for a leaked secret "as a first step you need to revoke and/or rotate that secret"²⁰. Rewriting history is not enough on its own: old commits may remain "in any clones or forks"²⁰.

Before any export:

1. List every repository, tracker and wiki in scope.
2. Revoke and rotate all secrets found anywhere in the history.
3. Remove customer data, production logs and copied fixtures.
4. Strip third-party code and record its licences.
5. Remove security-sensitive material, such as open vulnerability tickets and penetration test reports.
6. Share a small sample under a non-disclosure agreement before any full export. Turing, for example, asks sellers to run its evaluation script locally first¹.

What has code sold for?

Less than headline ranges suggest. The clearest public figures for code alone run from about USD 1,000 per pull request to USD 100,000 or more for a legacy codebase^2,6.

Code sales are now common in startup closures: 47% of SimpleClosure's shutdown deals include code or data sales⁶. But the six and seven-figure ranges buyers advertise cover a whole company's linked records, not a repository alone. If you are winding down, see closing a company; for other sectors, see our sector guide, and for which buyers take UK companies, our buyer comparison.

Related sectors: licensing manufacturing data for AI training and licensing law firm data for AI training.

See what your code, tickets and engineering records could be worth with a free valuation. It is confidential, we reply within one working day, and sellers pay nothing: see how we are paid.