I can see Matt’s point of view. Data transfer fees are expensive, especially at WordPress scale. Automattic probably covers a lot of that cost that wordpress.org is incurring and wants WP Engine to pay their fair share.
WP Engine also seems to do some other “not in good faith” things such as change the woocommmerce Stripe attribution from wordpress.org to their own Stripe account.
While the legal dispute is on trademark, I think it’s really on WP Engine profiting on wordpress.org without giving back. It’s not illegal, but blacklisting WP Engine isn’t illegal either.
Automattic is essentially subsidizing a private equity backed company. I’d be upset and frustrated too if I was in Matt’s position.
If you support WP Engine, you’re supporting Silver Lake Private Equity.
Another model I’ve seen is a combination of subscription and usage where there’s a monthly base and then additional charge for usage overages. Example is Sendgrid.
I was a Mintlify customer 6 months ago and found their onboarding strange. Their Github app asked for permissions to access all my repos and there was no way to get around that. I just wanted to give them access to my docs repo not my app repo. Ended up having to dig through their settings page and revoking that permission after onboarding.
For customer OAuth tokens, I believe you should NEVER store the access token in the database. Only store the refresh token in the database. When you need api access, get a new access token with the refresh token and client secret.
This prevents incidents like the above as the attacker would also need your client secret, which is ideally not in your database.