Inquiry regarding enforced limitations in v2.1.1+ and the long-term vision for self-hosted OSS

[iambluka4]

Hello Shuffle team,

I am an Information Security Engineer at a small organization (approx. 500 employees). We are currently in the research and testing phase of integrating a SOAR platform into our security stack (specifically to complement Wazuh and our other security tools).

Naturally, as an organization of our size, we are looking at the Community self-hosted version. However, I have some concerns regarding the recent shift in the project's direction.

In your official documentation (configuration.md), it is stated:
«Versions v2.1.1+ include strict, enforced limitations. We are now actively enforcing the differences between the Open Source (OSS) and Enterprise editions, differences that have always existed but were not previously enforced.»

While I understand the need for a sustainable business model, the security community is still wary after the "TheHive" experience, where the transition to version 2.0 and radical changes in licensing significantly impacted many SOC teams who had built their processes around that tool.

My concern is simple: If we invest time and resources into building our entire incident response logic around Shuffle, could future technical limitations potentially paralyze our operations?

I would appreciate clarity on the following points:

1. How far do you plan to go with these technical enforcements for self-hosted option?
2. What is your roadmap for maintaining the balance between a functional OSS tool and the Enterprise edition?

We really like the platform's capabilities, but we need assurance that the "Open Source" core remains a viable long-term foundation for our internal IR processes without the risk of a sudden functional wall.

Thank you for your transparency and for all the work you put into this project.

[ggambini]

Hello

Same kind of questions here. I choose shuffle for our micro SOC a year ago and starting integrate some use cases. I understand the need for shuffle team but IMO mountly app execution limit with OSS version is very questionable. Limitation like no clustering/scale-out, no OIDC/vault or apps, is ok for me and a lot of other projects already do this.

I will maybe contact sales department to have an idea about entreprise licence cost and licensing mode (by job, node, cpu, etc). And start looking for an alternative sadly.

Regards.

Edit: Maybe i misunderstand information about licence in my self-hosted instance. On official webiste, they dont talk about app execution limit : https://shuffler.io/pricing?env=Self-Hosted

On self-hosted side, mention about workflow exec limitiation :

And in /new-dashboard endpoint on self-hosted instance, a graph indicate a limit of 10k for app exec, im lost :)

[frikky]

Hey!

This has been coming for a long time I'm afraid. It is simply a question of how to make Shuffle as a company sustainable. We have been screwed over too many times where customers found the product to work too well to keep paying, and just ghosted us after paying for a single month of help, as it worked too well.

So here is the idea:

1. We don't really want to limit small operations. They typically don't hit the limits either way. We have given away licenses for free to core community members who have been significantly contributing to avoid issues here.
2. Limits are soft limits, that reset monthly. What that means is that Shuffle still works, but is slower on purpose. The way we handle this is slow it down to 1 Workflow Execution per minute. This is often enough for small-mid sized operations.

How it works in practice:

1. Versions AFTER v2.1.0 have limitations added to the Backend. The main limitation we focus on is Workflow Runs, not App Runs. And hopefully this limit will be raised as we found a good sweet-spot.
2. Shuffle is open source, not just open core.
3. We want people who are scaling or struggling to reach out, so we can earn money from what we have built for the last 6 years.

We aren't hiding anything. We just wanted to start paying the team what they deserve.

Hope this clears things up <3