Thanks for pointing this out, we are working on the licensing part now. We are not going to put anyone at risk of the licence misuse. Eventually we are going to have a multiple licensing model allow using Pony ORM for free for non-commercial and open source projects, but in the same provide a commercial license as well.

> are people who find the repo on github directly at risk of violating the license?

Nope, why? Using it under AGPL is a valid option.