Maybe there's a middle ground where the code itself is only made visible at the same time as the latest build.
This shortens the exploit window
There are some projects that only release sources as a flat tarball at the same time as a new release, no git history/repo is available.
There are some projects that only release sources as a flat tarball at the same time as a new release, no git history/repo is available.