Y Combinator-backed insurance startup Corgi has denied accusations that it copied software from Papermark, an open-source document-sharing platform, without attribution — a dispute that surfaced publicly on June 25, 2026, when Papermark's founder posted the allegation to Reddit's r/SaaS community.

The Papermark founder claimed that Corgi's data room product lifted code from Papermark's project, which is released under an Elastic License 2.0 (EL2) — not a permissive open-source licence. EL2 explicitly prohibits providing the software as a managed service or hosting it for third parties without a commercial agreement, and it requires attribution. Papermark alleged Corgi did neither. The accusation gained traction quickly, spreading to Hacker News within hours.

Corgi pushed back the same day. In a Hacker News thread, the company maintained that any similarities between the two products were coincidental, not the result of copying. TechCrunch reported on June 26 that Corgi stood by that position.

The EL2 licence sits in a category that the open-source community debates with some regularity — sometimes called "source-available" rather than truly open-source, because the code is publicly readable but the usage rights are deliberately constrained. Elastic introduced it in 2021 to prevent cloud providers from commercialising its work without contributing back. Papermark's choice of EL2 for its codebase means the central legal question is not whether the code was public, but whether Corgi's use, if copying occurred, fell within or outside the licence's permitted boundaries.

What makes this dispute worth following is less the specific accusation and more the structural tension it surfaces. Corgi is not a typical insurtech broker — it underwrites and issues policies directly as a full-stack carrier, a position that requires building and maintaining substantial internal tooling. According to its Y Combinator profile, it scaled from $0 to $100M ARR in seven months, a trajectory that implies rapid shipping across many product surfaces simultaneously. Data rooms — secure document repositories used during diligence and policy onboarding — are a natural ancillary product for a startup-focused carrier, but not necessarily a core engineering priority. That context does not establish wrongdoing. It does, however, describe conditions under which a team under pressure might reach for available open-source or source-available components.

The dispute has not, as of this writing on June 27, 2026, produced any disclosed legal action. Both sides have stated their positions publicly, and the facts about what code was used, when, and how remain contested. Without access to Corgi's codebase or a neutral forensic comparison, neither side's claim can be independently verified from published information alone.

Worth flagging: the EL2 enforcement landscape is still relatively thin in case law. Elastic itself has litigated EL2-adjacent disputes, but the licence is young enough that courts have not yet built up a thick body of precedent. For founders and engineering leads who pull dependencies from source-available repos — a common enough practice as GitHub's catalogue of EL2 and Business Source Licence projects has grown — this episode is a useful reminder that "the code is on GitHub" is not the same as "the code is free to use."

Corgi's broader profile adds a layer of public interest that a less visible company might not attract. YC S24 cohort companies operate under significant scrutiny, and a $100M ARR run rate at seven months makes Corgi one of the more prominent names from that batch. Whether or not the code dispute resolves in Papermark's favour, the reputational surface area of a fast-scaling company is considerably larger than that of an early-stage peer — and public accusations of this kind carry costs regardless of outcome.

The episode also reflects a tension that has sharpened as AI-assisted development has accelerated shipping velocity industry-wide. When teams can prototype and ship faster, the diligence cycle for licence review does not automatically keep pace. Engineering organisations that have not formalised licence-scanning tooling — solutions like FOSSA, Black Duck, or even GitHub's dependency review — are increasingly exposed. That is not an observation unique to Corgi; it describes a broad shift in how software gets built right now.

How this resolves remains an open question. The two most likely outcomes are a negotiated attribution or licensing arrangement, or a quiet divergence where Corgi demonstrates the codebase independence it claims. Either way, the public record of the accusation and denial is now established.