With source code available attackers are white-box testing as opposed to black-box testing. Black-boxing is where you throw known arguments at a system and mea

With source code available attackers are white-box testing as opposed to black-box testing. Black-boxing is where you throw known arguments at a system and measure the responses, and hence deducing what the system is doing White-box testing is knowing what is happening internally, so you can immediately skip to step two of a security test - which is exploiting. With black-boxing it takes a very very long time to learn the entire system and its workings, but it can be done. Having the code just means skip that test. For eg. with Diaspora from it launching to it being exploited was a matter of minutes. The Twitter URL escaping bug from this week was from within one of their public source code repositories. While they don't release everything as open source, they have released enough to give an attacker a good view of their stack and how it works. Bugs not detected in the open source code are likely to also appear in other parts of the platform that are closed source (since they weren't detected in the first place)