So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application allows users to form teams (which can be private). The API serves requests coming from Slack and also from a client website. Metadata about user communications on slack is also collected by the API.
Assuming no secrets are exposed in the codebase, would it be ok to keep the repo public?
The main arguments for making it public are:
- Keep the project open source.
- It can be a useful GraphQL learning resource.
- Access to workflow tools that are only free for open source projects.
- Get community help on finding and patching exploits.
The main arguments against making it public are:
- If there is something we missed or forgot to secure it could be exploited.
- People would figure out how it works internally and maybe try to mess with things that arent thoroughly validated yet.
- If we are ever careless and accidentally commit something sub-par that could create problems too.
What's the best approach here? Thanks for any help.