Your analysis of why they might have this seems insightful, but your advice on what to do doesn't sound quite right to me. In my mind, it all depends on which s

Your analysis of why they might have this seems insightful, but your advice on what to do doesn't sound quite right to me. In my mind, it all depends on which sort of "open source" license you used: a "viral" one like the GPL or a "free" one like BSD or Apache. You wrote "remind them any future changes they make have to be open source as well" and "have your lawyer sent them notice that you want to audit all their code to make sure any derivation of the project is properly open sourced"; both of these apply only if you used a "viral" style of license. And the original poster didn't... she used the Apache license. By using that license, she already gave this startup (and anyone else) permission to use the code, and to build a whole business on the code, without ever paying the original poster one cent or even giving credit. We (those of use who release under open licenses) do this because on the whole, everyone benefits when we all use open licenses. I would venture to say that there is no developer anywhere who has not GAINED more benefit from the use of open source software than they have given up by releasing things they wrote. But occasionally there is an asshole like (apparently) this startup. And one right that the original poster did NOT give up by using the Apache license is the right to speak honestly. The advice "Tell the investor you own the IP" seems dead on. It may turn out that there was a miscommunication -- that the startup founders were explaining that the features THEY added were theirs and the investor misunderstood and thought they were claiming the underlying code that the OP wrote. If so, sort out the communication mixup and then perhaps you and this startup have a future together. Or perhaps (and this DOES happen) the startup founders were simply lying to investors. In that case, telling the investors about it won't win you any friends, but it might make the world a tiny bit better.