Discussion on SaaS release security auditing/public repos

So, in a SaaS where you're dealing with auth/payments and also potentially using lots of random libraries that may or may not be using GPL licensing(which apparently requires you to be able to show your entire codebase if asked)... Wanted to discuss what your guys' thoughts are when you sell your SaaS's...

The public repos thing, my concern is you may be slightly less secure by disclosing how exactly your app works down to the database schema/routes/etc... As in obscurity. But if you develop with an open codebase then the licensing issue could be easier to deal with... granted there is still a problem of "can I sell this service while using this library". I'm still brushing up on the licenses eg. Apache/MIT/GPL/etc...

Lastly, do you get your site audited/pen tested... I mean hopefully you have your basic things in place eg. sql-injection/xss/csrf/etc... maybe CDN/scaling/all that.

It does help that you kind of abstract away the payment thing by using something like Stripe so you don't store anything on your side in case of a breach/middle man exploit. Hopefully any data stores either have no PII or are encrypted at rest.

The auditing thing, it's interesting of an idea but how do you know that the people doing the auditing are legit/competent. Is there some kind of "if you get breached we owe you money" sort of thing... I don't know. I'm still dealing in peasant scale but would like to have good security practices in mind.