Should I Open Source my Company?

Summary

Software founders often hesitate to make their companies open source due to concerns regarding code scrutiny, security exploits, and intellectual property theft. Supabase operated as an open-source business from its inception, finding that community scrutiny actually accelerates code refactoring and surfaces security vulnerabilities early through public reporting channels. In addition, rapid execution and developer experience provide stronger competitive defenses against larger competitors than proprietary code obfuscation or software patents. Open repos also transformed the company's hiring strategy by replacing traditional take-home tests and LeetCode interviews with evaluation of real-world pull requests and asynchronous discussions. Finally, external contributors expand product capability by independently developing niche integrations and platform adapters that core startup teams lack the bandwidth to build.

Context

Software founders frequently avoid open-sourcing their businesses due to three primary fears: public criticism of messy code, malicious exploitation of exposed security vulnerabilities, and intellectual property theft by competing firms.

Approach / What changed

Supabase made its codebase open source from inception, relying on public security disclosure via security.txt, treating developer experience and execution speed as defensible advantages, and hiring developers directly from repo contributors.

Takeaways

• Direct community contributions allow companies to assess asynchronous communication and real-world code quality, eliminating the need for LeetCode evaluations and outbound recruiting early on.
• Exposing source code allows independent security researchers to identify and report vulnerabilities early, creating more robust software security over multi-year timeframes than closed systems.
• Open-source models enable community members to build long-tail features and integrations, such as cloud platform adapters, that startup teams cannot prioritize while focusing on majority user requests.

Related reading

• Supabase · Dec 17, 2021

  Holiday Hackdays Winners 2021

  Supabase organized the Holiday Hackdays 2021 hackathon following their launch week and announced the winning and runner-up community submissions. Selected winners include Swappy.one by Zernonia, the realtime polling platform rtPoll by Emilio and Federico Schepis, Santa Banter for holiday jokes by Andy Keogh, and the wishlist app the get list by glowdexapp. Recognized runners-up include Chivel for YouTube channel landing pages, the end-to-end encrypted e2ee-chat, a Flutter-based Holiday Sweater voting app, and a greeting card platform built by high school hackers. Winners receive limited-edition gold medal shirts, while runners-up earn silver medal shirts. All project submissions were made available for viewing on madewithsupabase.com.

  Thor Schaeff

• Supabase · Mar 28, 2022

  Community Day

  Supabase initiated its Launch Week with Community Day, announcing a series of ecosystem updates, security integrations, and open-source contributions. Through a partnership with GitHub, secret scanning now detects exposed Supabase service role API keys and automatically revokes them to prevent unauthorized database access. The pre-release of PostgREST version 10 introduces arrow operator queries for composite types and array elements, structured PostgreSQL-compliant error messages, and automated recovery from Linux EMFILE conditions. Authentication features expanded with four community-contributed OAuth providers, two phone providers, email one-time passwords via verifyOTP, and framework-specific supabase-auth-helpers starting with Next.js and Nuxt. Finally, Supabase launched a partner gallery powered by Postgres Full Text Search alongside educational courses and an upcoming ten-day virtual hackathon.