I haven't released source for either of the projects I've released so far in graduate school because they are attack projects that demonstrate security flaws. I

I haven't released source for either of the projects I've released so far in graduate school because they are attack projects that demonstrate security flaws. It is not so clear that there is "no excuse" not to release them. Another reason not to release source code is that there might be obvious follow-on work and you want to publish that paper too, rather than help someone else scoop you by giving them your tools.