Sidebar on the CRA, which was mentioned

They are describing a support contract. So it means, if you have a support contract in place, you cannot delay fixing security issues. So if you offer support contracts, the CRA is basically saying you MUST include security issues, and you MUST issue timely fixes. So any attempt to dodge this issue in your contract is void.

If you're accepting donations towards your hosting costs (or charging for the cost of providing said host, and explicitly NOT including support services) you can't be held liable for anyone else's software, and quite likely not your own either.

> Accepting donations without the intention of making a profit should not be considered to be a commercial activity."

So actually making a profit (if it wasn't your intention) isn't a problem.

Cheers,
Wol