If you upload the source code first, someone else might use it while you wait for the months that the paper publication process takes. That's a risk if you want

If you upload the source code first, someone else might use it while you wait for the months that the paper publication process takes. That's a risk if you want to claim your idea as new. That's no excuse not to update arXiv, though. They have a form to submit code and supplemental URLs after publication. They also allow you to post a new PDF revision with supplementals attached.