For cryptography, it is considered good practice to release the code so others can audit it...is this also true for penetration testing software?

  • From my personal experience, you do NOT get audit of your open source code. It gets used and you get bug reports, or it does not get used and only hackers find the bugs... Feb 7, 2015 at 1:34
  • On github you can create "pull" requests, which ask for others to join your project...this requires it to be open-source if your github account is a free one. Regardless, if you receive a bug report wouldn't that be an audit of sorts, and still be helpful?
    – user67862
    Feb 7, 2015 at 1:36
  • 1
    Yes, but first you need a rather large user base. If you get 10 or 20 users, you'll get nothing. If you have over 100, 1 or 2 may report problems they encounter (i.e. not an audit). If you have 1 million, now you're on the right track, but quite unlikely to get there. Feb 7, 2015 at 1:38
  • Good point. In counter to that, the only thing I can think of is a 'bug bounty' program, which would cost more than it may be worth.
    – user67862
    Feb 7, 2015 at 1:53

2 Answers 2


Linus Law (the more people have access to the sourcecode, the more people will find and report bugs) only applies when people have an incentive to get bugs fixed. This incentive usually only exists when they use the software. So when your software is highly optimized for you and you don't expect that a larger community will form around it, you won't get many bug reports and patches out of it.

Also, even when your software gets widely used, this is no guarantee that people will audit it properly for you. A good example is the heartbleed bug, which was a quite typical security vulnerability in a very very widely used piece of open source software.

When it comes to pen-testing software there is also an ethical component to consider. Is your software really only useful for penetration testing, or can it actually be abused for cracking? You might not want to hand script kiddies the tools to cause damage and bring themselves into legal problems.


It depends on what software it is, I imagine you get far more scrutiny for open source AV/firewall or anything that listens on a socket with a privileged account. However something like a CLI application to generate shellcode will probably only receive QA type responses.

You must log in to answer this question.