Comment by sjpb

Well, I think this is what SchedMD do with Slurm? GPL code. You can sign up to the bug tracker & open an issue, but if you don't have a support contract they close the issue. And only those customers get advanced notice of CVEs etc. I'd expect nearly everyone who uses it in production has a support contract.