It isn't open sourcing that increases risk, it is the open repositories. It is a vital distinction to make. Code needs to be scanned for secrets even in closed

It isn't open sourcing that increases risk, it is the open repositories. It is a vital distinction to make. Code needs to be scanned for secrets even in closed repositories because of insider threats. But opening them up guarantees your mistakes will be caught by, ah, volunteer sysadmins. I understand you're pointing out that fuzzing the distinction is a way for someone with an anti-open-source agenda to advance their efforts, just trying to make the point explicit.