The DIY Delusion: Why Building Your Own Commerce Engine in the AI Era Is a High-Wire Act Without a Net

Written by Brad Buhl

Published on Nov 10, 2026

I've spent 13 years at Broadleaf Commerce in sales, marketing, and strategic partnerships, and I've worked on dozens of enterprise implementations. In that time, I've watched the same movie play out again and again.

It starts at a whiteboard. An engineering team, tired of a rigid legacy platform, asks: "Why pay a vendor when we can build this ourselves?" Generative AI has made that question louder. If an LLM can write a working microservice before your second coffee, how hard can a commerce engine be?

Harder than it looks. Writing a feature is the easy part. Keeping it secure, compliant, and working through ten years of upgrades, audits, and changing customer behavior is where the cost lives. Build your commerce stack entirely in-house (what I call the "DIY Delusion"), and you become your own software maintenance vendor. Nobody pays you for it.

Here are three risks a commercial framework like Broadleaf takes off your plate.

1. Dependencies: someone has to patch them

Nobody puts "spent three weeks chasing a vulnerability in a dependency" at the top of their performance review. But that work never stops.

Build from scratch, and you own your entire software supply chain. Broadleaf maintains, tests, and hardens more than 100 open-source dependencies across our platform, from Spring Boot to data connectors to messaging. Because our customers run large transaction volumes on that same stack, we usually see vulnerabilities, performance problems, and regressions before a single internal team would.

The numbers show how big the job is:

Black Duck audited 947 commercial codebases for its 2026 Open Source Security and Risk Analysis. 78% had high-risk open-source vulnerabilities, and 92% contained components four or more years out of date. The average codebase carried 581 known vulnerabilities, more than double the year before.
AI makes it worse. In Sonatype's 2026 State of the Software Supply Chain report, GPT-5 recommended a version that doesn't exist for 27.8% of nearly 37,000 dependency upgrades, and in some cases pointed to packages that had already been hijacked. A USENIX Security 2025 study found that 19.7% of packages suggested by code-generating LLMs didn't exist at all. Attackers now register those made-up names and fill them with malware.
Keeping up isn't cheap. Sonatype estimated that upgrading every component to its latest version costs about $29,500 and 314 developer hours per application.

If you roll your own, your team watches every National Vulnerability Database alert, tests every patch across 100+ libraries, and ships the emergency fix when a zero-day lands on Black Friday. With Broadleaf, we do that work, so your developers can spend their time on features that make money.

2. Legal exposure: unsupported open source comes "as is"

Nobody's favorite topic at 4:30 on a Friday, but ask it anyway: if a third party claims your custom platform infringes their copyright or patent, who defends you?

Read the warranty clause in nearly any open-source license: MIT, BSD, Apache 2.0 (Section 7), GPLv3 (Section 15). It's in capital letters for a reason. The software is provided "AS IS," without warranty of any kind. Some licenses, like Apache 2.0, pass along the contributors' own patent rights, but none of them promise to defend you against anyone else. When you assemble a platform from open-source libraries and AI-generated code, you're the author, and the defense costs and any settlement are yours.

AI adds a new wrinkle. Black Duck found license conflicts in 68% of audited codebases this year, up from 56% and the highest in the report's history. It points partly to AI assistants reproducing copyleft code without its license attached. Courts are still working out the rules: in September, the Ninth Circuit upheld the dismissal of one claim against GitHub Copilot, but left other questions about AI training and copyright open. Unsettled law is a shaky foundation for a revenue-critical system.

Broadleaf's enterprise agreements include IP indemnification and commercial warranties. We stand behind our software and defend our customers if it's challenged, so that risk moves from your balance sheet to ours.

3. Every line you write is a line you maintain

There's an old rule in enterprise software: code is a liability, not an asset. Every custom line you write today has to be documented, upgraded, refactored, and fixed tomorrow.

US federal agencies report spending about 80% of their $100 billion-plus annual IT budget operating and maintaining existing systems, according to the GAO.
In a McKinsey survey, CIOs said 10–20% of the budget meant for new products gets diverted to tech debt, and estimated that tech debt equals 20–40% of the value of their entire technology estate.

Build it alone, and every change in payment rails, tax rules, or compliance mandates comes 100% out of your budget.

Broadleaf works differently. We keep improving the platform based on what customers across retail, B2B, and marketplaces need, and you pull those upgrades in on your own schedule. When you need something that isn't on our roadmap, our Roadmap Acceleration program lets you fund it once. We design it, build it into the core platform, and maintain it in future releases. You pay for the innovation one time instead of carrying it forever.

Control without the overhead

There's real pride in saying "we wrote every line of our stack." But pride doesn't pass a PCI DSS audit or answer a patent claim.

Customers don't choose you because you wrote your own shopping cart or order state machine. They choose you for the experience, the merchandising, the pricing, and how fast you ship. Broadleaf gives you a framework you can customize as deeply as you need, with a team handling the security, legal, and maintenance work underneath it.

Keep control of your commerce roadmap. Just don't build every road by hand.

Questions we hear

AI writes code so fast now. Doesn't that make building cheaper than buying?

It makes the first version cheaper. It doesn't make year five cheaper. The expensive part of software is patching, upgrading, and changing it after launch, and AI-generated code adds more dependencies and more license questions to manage. Use AI to speed up the work that sets you apart, not to rebuild the parts every retailer already has.

We already run plenty of open source. Why is commerce different?

Commerce code touches payments, customer data, tax, and PCI DSS scope, and it has to stay up on your busiest day of the year. A gap in a logging library is a nuisance. A gap in checkout costs revenue and can trigger an audit. That's where having a vendor who maintains and stands behind the code matters most.

Won't a platform lock us in?

Broadleaf is a framework, not a closed box. Enterprise customers get access to source through their IDE (making both development and production support faster); it runs on Java and Spring like many in-house stacks, and you can extend or override nearly any part of it. You own your customizations and your data.

What does IP indemnification actually cover?

In short, if someone claims the Broadleaf software you licensed infringes their intellectual property, we defend you and cover the resulting costs, subject to the terms of your agreement. The specifics are in each enterprise agreement, so ask us for the language during evaluation.

How does Roadmap Acceleration work?

You fund a capability that isn't on our near-term roadmap. We design and build it into the core platform, and it ships with future releases so you aren't maintaining a one-off fork. Other customers may benefit from it too, which is part of why the cost to you is lower than building it alone.

Can we still customize everything?

Yes. That's the point of a framework. Most teams spend their effort on the customer experience, merchandising rules, pricing logic, and integrations, and leave cart, order management, and security plumbing to us.

Is building in-house ever the right call?

Sometimes. If commerce is a small, simple part of your business, or your model is so unusual that no platform fits, building can make sense. Just budget for maintaining it as a product for its whole life, not as a project with an end date.