Why innersource practices matter for security
Open source development has proven that distributed teams can produce code that is reliable, reusable, and secure. When enterprises apply the same principles internally—sharing templates and reusable components across team boundaries—it’s called innersource. This approach standardizes user experience and can boost developer productivity by up to 87%.
But innersource only delivers value if you track both the volume of reuse and the quality of what’s being shared. An innersource portal that makes repositories discoverable also creates a concentration risk: one flawed component can propagate defects across every service that depends on it. Measuring and securing your most reused code becomes the critical control point.
Putting security metrics in the discovery flow
For one government agency working with the GitHub Professional Services team, the solution centered on a custom portal for discovering reusable code, built on an open source SAP project. As developers adopted the portal, their most-shared repositories became dependencies for nearly all active work. That made security monitoring of those central repos a top priority.
The agency embedded metrics directly into the portal to surface the security posture of its most innersourced repositories. These metrics refreshed automatically every day, letting the team focus its security review on the components with the highest reuse and therefore the broadest impact.
Combined with GitHub Advanced Security scanning—both secret scanning and code scanning—enabled across all 400+ innersource repositories, those metrics drove a 50% reduction in vulnerabilities across their shared code.
A practical path to secure innersource
Any organization can build on what this agency achieved with a straightforward sequence of steps:
- Find reusable software already sitting inside your enterprise teams.
- Make those repositories discoverable through a central catalog or portal.
- Instrument the key repositories with metrics that track security and quality over time.
- Act on the data to fix issues where they have the most leverage, then publicize the improvements.
The portal’s discovery functionality and the daily security metrics worked together: reuse went up, visibility into what was being reused went up, and the agency could apply targeted fixes to the code that mattered most to the organization’s broader software supply chain.
