We are developing a kind of social platform. It starts as a closed beta for a limited number of users, but the goal is to reach millions of subscriptions.
We are currently limited on resources, both infrastructure and e.g. DevOps. So we are using GitLab for versioning our source code.
Let's assume, we make it and in few years the service has million users. How do you feel about using GitLab for versioning of the source code at this stage? Do you see it as a significant security threat? A few reasons to consider:
- there is no possible real warranty that staff from GitLab cannot investigate the source and find security holes or some sensitive configuration.
- GitLab staff could sell sourcecode to some third party
- GitLab may be forced to provide the sourcecode to some government, without us to know it
I know the points will sound paranoid. The purpose of the network is completely legal and ethical, but I believe any service of this kind must protect the privacy of its users. The plan is to move to our private servers later, but we have to start somehow.
So, do you think it is OK to use private GitLab or Bitbucket repositories for the early phase of the project, or is it an unacceptable security threat?
Disclaimer: I don't claim GitLab would do anything of the described.