In a way. The difference is that if you develop something with public source code, you're vulnerable from day zero of development. That means severe vulnerabili

In a way. The difference is that if you develop something with public source code, you're vulnerable from day zero of development. That means severe vulnerabilities are more likely to surface before the product is mature enough for those vulnerabilities to represent massive risks. OSS applications benefit from survivorship bias: the code that's there probably contains fewer vulnerabilities because any vulnerabilities that were there have likely been exploited already, allowing them to be detected and fixed. Meanwhile if you allow a closed code base to grow and mature for years and then expose it to the prying eyes of the public, it might contain a few bangers that would have been caught much earlier if the code had been developed in public. Of course this assumes that vulnerabilities get fixed and dev teams learn to avoid them once they've found them. This somewhat breaks down in typical plugin-heavy open source stacks where any random plugin might be developed by a 13 year old in their bedroom and no longer maintained and your flagship product now depends on it because nobody noticed its glaring security flaws. Though this can be managed and avoided somewhat by being more deliberate when picking out plugins. EDIT: A really straightforward example is committing unencrypted secrets (API keys, passwords, whatever). In an OSS product this will likely be exploited almost instantly but this creates cultural awareness to not do that (either by learning from mistakes or by being told horror stories about those mistakes). In a closed source product this could easily go on for years with no consequences until someone exposes the code to the public.