Obviously, this is a complicated topic but I was wondering about how well are the projects like Postgres protected when people make contributions to them? They don't require any CLA signing etc, and their only defense seems to be "you should have read our policy", which isn't obvious to a casual contributor, or easy to discover (it's mentioned in a policy regarding archival of emails [1]).
> Additionally, source code submissions to mailing lists such as pgsql-hackers are considered submissions to the PostgreSQL project, falling under the project's PostgreSQL licence. Please make sure you have permission to share information with these lists before sending your message.