DEV Community

Discussion on: Is open-sourcing server-side code a security threat?

Collapse
 
quoll profile image
Paula Gearon

I want to add to what everyone is saying. "Security by Obscurity" is a well known security mistake, so much so that there is a Wikipedia page for it. You aren't obliged to put your code out there, but if you think that you're gaining something by keeping it secret, then:

  • You're not.
  • You're likely to be complacent about other areas of security, due to believing that this provides a layer of security.

Keeping the source secret is not a flaw in your security, but you really can't rely on it doing anything for you.