# A Volunteer Label Does Not Remove a Sponsorship Conflict ## Claim Calling a plugin-review or security-review role "volunteer" does not remove the conflict of interest created when that reviewer's paid work is sponsored by a company with plugins under the same team's review. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Applies to open-source governance structures where review authority is nominally volunteer-staffed but individual reviewers hold paid, sponsor-funded roles elsewhere in the same ecosystem. - Doesn't claim any specific instance of this pattern is proven — this is a structural claim about what the "volunteer" label fails to disclose, independent of whether particular named allegations (e.g., the WPForms/Awesome Motive case that prompted this note) hold up under verification. - Shared or institutional review aliases compound the problem: they make it harder to attribute a specific review decision to the individual who made it, which is a separate but related accountability gap. ## Evidence A WordPress security researcher argued that responsibly-disclosed bugs and deliberately undisclosed vendor mechanisms are different failure categories, then extended the argument to governance: naming individuals alleged to be both paid contributors to a plugin vendor and members of the WordPress.org review teams reviewing that vendor's plugins, plus an alleged additional sponsor relationship. The specific named allegations are unverified. The structural claim — that "volunteer" framing can mask a real conflict — stands independent of whether this particular case is confirmed. ## Links - [[3. Resources/Literature Notes/When WPForms Had a Real Bug — Arbitrary File Access]] — because evidence-for; the source thread that prompted this generalized claim. - [[3. Resources/MOCs/Open Source Governance MOC]] — because applies-in; conflict-of-interest disclosure is core governance infrastructure, not an edge case. - [[3. Resources/Permanent Notes/Public Credit Mechanisms Are the Visible Skeleton of Open Source Social Contracts]] — because extends; both claims turn on whether contribution/review credit is legible enough for the community to audit who did what for whom. ## Tests / falsifiers - Find a documented case where a sponsored contributor's review decision was later shown to favor their sponsor's plugin against normal review standards — that would be direct confirming evidence for the mechanism (not this specific unverified case). - If review teams with sponsored members show no measurable difference in review outcomes for sponsor-affiliated plugins versus unaffiliated ones, the conflict may be structurally present but not practically consequential — worth revisiting the claim's strength, not its existence. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Literature Notes/When WPForms Had a Real Bug — Arbitrary File Access]] — reports the named-individual allegations and the sponsorship-conflict argument this claim generalizes from, stripped of the unverified specifics.