I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, not even SVN), to let others contribute to the project, and also perhaps using it to let my potential future employers see some of my code as some sort of curriculum.

But what I'm wondering now, and I'm suprised I haven't seen anyone mention it before is the security aspect of it. Isn't publishing the code of a website a HUGE security hole? Is like giving a potential hacker or anyone who would like to find any potential exploit possible, even considering that the critical files aren't uploaded (database passwords, authentication scripts, etc.).

Of course that there are millions of projects uploaded to GitHub and no one will find mine just 'by chance'. But if they look for it, it would indeed be there.

Bottomline: my problem is not about copyright or licenses, but others finding exploits in my website.

I'm I missing something here?

  • 4
    Security by obscurity hasn't worked well for most software so far. Source code is but one piece of the puzzle! Nov 24, 2012 at 10:28
  • 2
    Use BitBucket instead. It supports git as well.
    – Job
    Nov 24, 2012 at 14:31
  • So don't have obvious exploits in your website for people to find? For example, if people can tell from your source code where the SQL injection vulnerabilities are, then so can you.
    – user16764
    Nov 24, 2012 at 18:12
  • As @delnan points out below, GitHub allows you to host private repos for a price. Aside from the millions of public (open source) projects you can indeed see, there's probably millions of private projects on GitHub that no one outside the owner/collaborators of the project will ever see.
    – Suman
    Nov 24, 2012 at 18:50
  • 1
    If nothing else create a local git repo. That way you can at least rollback when you make a mistake.
    – Zachary K
    Nov 24, 2012 at 18:59

5 Answers 5


I'm I missing something here?

Yes. Relying on people not knowing your source code to prevent them from finding security exploits in it is known as security through obscurity.

The problem: it doesn't work. Skilled hackers don't need the source code to find and exploit vulnerabilities. They'll do some fuzzing to find input that causes problems and then use their knowledge of how the underlying OS/language/framework works to identify a vulnerability.

It is widely agreed that having the source code public increases security by enabling well-meaning people to find vulnerabilities and fix them, or at least tell the developer about them. There are two important reasons why this works:

  • There are generally more well-meaning than malicious people
  • Any vulnerability found by a well-meaning person will be fixed for everyone; hackers are far less likely to collaborate

Of course it doesn't work with pet projects that have few active users, but those are also exceedingly unlikely to be targeted by a hacker.

  • 2
    Not that I agree or disagree, but "widely agreed" by whom? This is not a sentiment that I've actually heard expressed. Nov 24, 2012 at 10:22
  • Thanks for the quick response man! And it does make sense when I think about it, it's a trade-off between sharing something that would have already been found by skilled hackers and getting proper input from well-intentioned programmers. Clearly I hadn't though about it this way.. Thanks again!
    – federico-t
    Nov 24, 2012 at 10:25
  • @SnOrfus: see Linus' Law and Kerckhoffs's principle. Admittedly, "widely agreed" may be a bit of an exaggeration, but I'd wager that the majority of experienced programmers would agree. Nov 24, 2012 at 10:36
  • 1
    @MichaelBorgwardt, I'd wager that the majority of experienced programmers would disagree. So-called "more eyeballs = less vulnerable" isn't based on actual proper research. Heartbleed is not the first and will not be the last. Also see blog.codinghorror.com/given-enough-money-all-bugs-are-shallow
    – Pacerier
    Jun 5, 2015 at 9:12
  • 1
    @Pacerier: I'll take you up on that wager anytime. Note that the statement is that open source increases security, not that it results in perfect security. You can cite examples for bugs in OSS until the cows come home and it proves absolutely nothing to the contrary. There actually is proper research: archive.wired.com/software/coolapps/news/2004/12/66022 - yes, it's over 10 years old, but until you can find something concrete with contrary findings, it stands. Jun 7, 2015 at 20:31

First off, you can use (distributed) version control without making the repository public. You can just create a repo on your local computer, and push to/pull from other computers. You can also upload the repository (giving you more backups and easier collaboration) without making it public. GitHub offers private repos for a fee, Bitbucket does the same and makes small (5 persons or something) private repos free. Of course, then you don't get the other benefits you mentioned.

The security aspect is rather small. There are many, many worthwhile attack vectors which can be tested out easily without looking at the (server-side) source code (like being attentive to GET and POST parameters, checking cookies and session handling, adding inputs that ought to get escaped and check if they are, etc.). If you're vulnerable to any of them, a determined attacker can exploit them reasonably quickly without looking at the source code. More obscure and harder-to-exploit errors are (probably) also harder to spot in the source code, so again, you don't lose much.

On the other hand, making it public and accepting contributions may attract people who can spot exploits, without ill meaning, and tell you about them (or even fix them themselves). This goes doubly if it's really popular but you're not a security expert (no offense, but you don't sound like one; for example, you didn't mention security through obscurity and how your concern is not a case of it).

  • Like I told @Michael Borgwardt this makes complete sense. I'm guessing the benefit of publishing the code is even bigger when more people know about the project and provide contributions to fix exploits. And if it wasn't popular, most likely the potential hackers wouldn't care enough about it either. Thanks for the answer!
    – federico-t
    Nov 24, 2012 at 10:30
  • As far as I can tell, github doesn't offer free private repos (a minor correction, not a nitpick).
    – scrwtp
    Nov 24, 2012 at 10:33
  • @scrwtp: 'for a fee' is not the same as free. Nov 24, 2012 at 10:34
  • Ah, true, I misread.
    – scrwtp
    Nov 24, 2012 at 10:34

BitBucket has free private repos and supports both git and mercurial.


Setting aside the issue of security and whether making your code public would enhance it or not, you can setup a source control system on your machine yourself. In case of git it's trivial, just initialize a local repository and you're done, but setting an SVN also isn't a daunting task. Maybe an hour or two following the tutorials, if you have little prior knowledge on how to setup SVN.

So you can still benefit from source control, regardless whether you end up using an online service or not.


Most malicious hacking is done anonymously. Some person in Russia running a script that scans hosts for open ports, or what-have-you. No one is going to explicitly pour over your code just to find a way to hack in to do harm. Not unless you really piss someone off.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.