Haha yeah no, Epic Games is a software company, they should have known better, period. Asking for free labor from people who already created a free product you want to use is disrespectful and clearly incompetent. It's not my responsibility to arrange your business, and make a reasonable counter-offer. I'd just want to say "no, thanks but no thanks" and risk Epic Games not utilizing my OSS project. If they think that's too bad for them, it's their responsibility to then follow up and make a $$$ offer for the labor they request.

In fact my point is : I don't find a citation of the mail stating they refused to pay. What I understand of the twitter feed is :

- someone sent a (probably mass vendor targeted) mail asking for a form filling.

- The author interpreted they wanted it for free (which is not even absurd : some open source project have commercial licences and could use both a whatever security standard compliance to gain commercial value AND the legit right to add a big company name on his website) and was outraged because the email didn't contain a commercial offer.

I may be wrong, but IF the mail was really targeted at him (other comment point a believable theory : the security guy mass sent the mail to every 'vendor' lib in the folder, either by mistake or lack of caring) he just panicked and (if he wanted money) missed a business opportunity by either sending a quote for the form filing, trying to negociate an enterprise grade support/consulting or just politely responded "I'm an open source free code provider and have no financial interst in being used by you. Have a nice day."

I have been requested heavy paperwork kiling to allow my work as freelance to be used with 'big client', sended bills for it, and never had a problem with it. Never the funniest part of the project, but money is money.

I just didn't respond. I don't particularly like Epic Games anyways, and it's honestly not worth my time, since they'll likely end up using my role or forking it anyways. I mean, that's why I slapped the MIT license on it!

I get around 50 unsolicited emails a day, many asking for help with my OSS projects, but rarely is there something as cookie-cutter as this that's not outright spam.

I wasn't outraged, more like bemused that they'd think an OSS maintainer for a small personal project would care to spend hours working on security documentation for a little project that's like 1 KB of code.

I'm glad for you to hear it was a "rational" response and you were really not interested. The fact the project was 1KB of code was also unknown of me be reading the tweets, and explain furthermore the reaction :)

Surely they should be offering to pay if they're one of the biggest games companies and want you to fill out a form.

If someone's giving something away for free you don't ask for a guarantee, and if you want one for what ever reason you should offer to pay.

You mention greed, but epic seems to be the one wanting the cake and eating it too.

So yes I agree with the "how dare they".

Funny, probably a cultural thing, in France (in my experience, it maybe depend the context) when you have a special request from a professional entity (company or freelance), you describe your need, the professional say if he can do it, and make a quote. But the client never talk money first. They never said they would no pay a dime, just stated a request.

If they were asking a company/corporation, yeah, maybe.

But this is a small open source project with a single maintainer on a personal account on GitHub.