Background information:

I am a manager of a SaaS CRM application for a highly competitive industry. We have a large number of users who utilize our platform as the back-end of their business.

It was brought to my attention that my company was considering offering some clients the ability to purchase/license a copy of our code-base so that they can host their own copy, and continue development with their own team. This is so that they can build all of the features that they specifically want on their own schedule.

The question:

I can imagine that there would be many security implications with doing something like this, but I am having a hard time pinpointing specifics.

Here are some of my initial concerns:

  • It adds a big hole from which the code could get leaked out. This could potentially allow others to recreate our application.

  • An unscrupulous actor could utilize the source code to find vulnerabilities that would be present in our main version as well. We are always on the lookout for these potential vulnerabilities, but I would think that someone with full access might be able to find specific weaknesses which were overlooked.

While these issues seem like pretty big red flags to me, I was wondering if anyone else has experience with this type of thing. Are there any other things to be concerned about here? Is there any way to make it safer?

1 Answer 1


From a business perspective, you should be covered by copyright law, in addition to (and underlying) the licensing contracts with your customers. It's certainly a risk, but lots of companies actually open-source their code (or found their business on developing open-source code directly), and many others will share source without licensing it for redistribution. Up to your company if these risks are acceptable; talk to a lawyer about the legal details. I'm not going to say more from this standpoint; it's really outside of the scope of the site.

From a security standpoint, it's true that exposing your source code increases the likelihood of vulnerabilities being found - access to the source is classically one of the defender's advantages over attackers - but that's not all bad. By licensing your code to customers, they will be motivated to report any discovered vulns to you; they'll want you to fix them because they don't want their own data to be at risk. It's also worth remembering that while security research is generally legal, exploiting vulnerabilities (or attempting extortion over them) very much is not; even if the person finding the vulns is totally amoral, the incentive to exploit the vuln needs to be pretty great to overcome the risks of personal legal consequences. Unless the software is really popular, or provides access to very valuable assets, the benefits of exploitation often don't outweigh the risks.

In terms of making it safer, a lot of that will just fall on your company's security posture. How much security review has this product seen already? Have you had professional (internal or external) pentesters perform a thorough review including code analysis? Do you use static analysis tools? Do you have a bug bounty program (publicly, or privately but such that you could invite anybody who reported an issue) to incentivize disclosing vulns to your company? How often do you find vulns internally? How often are they found externally? How quickly can you resolve them? Do you have secrets your app depends on? Do they need to be distributed with the app? Can they be unique per customer? Can they be rotated easily in the case of exposure?

Once you answer all those questions, you'll have a better idea what risk you're taking on. I have seen SaaS products that had bundled or even hardcoded secrets (e.g. credentials to an external email account) that caused a problem when they distributed the app for on-prem deployment. I've seen apps that had obvious security issues - not even the kind of thing you need source code to find - that were immediately pointed out during the demo period. On the other hand, these findings led to improvements that the product and all of its users benefited from. I've also seen companies use access to the app's backend to build useful tools on top of it, expanding the usefulness of the app without the developer needing to implement the functionality themselves.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .