A serious security issue indeed, if someone knows the hash. How I manage this is that every time I want to open-source a previously private feature, I take the

A serious security issue indeed, if someone knows the hash. How I manage this is that every time I want to open-source a previously private feature, I take the changeset diff and apply that to the files in the public repository. Same features, but plausibly different hash.