Partially correct: we don't give away the source, but we also don't use your credentials.

We use the official cloud CLIs (gcloud, hcloud, aws, az, vultr-cli) that are either already signed in or not. If not, we detect using their subcommands to display login status, like gcloud info, etc). If not signed in, we ask if you want to sign in, and if you do then the official cloud CLI does the sign in and handles your creds however each one does. That might sound like splitting hairs, but to me that approach made much more sense that trying to safely handle your creds!

You might be wondering why not give away the source code? I tried this over the last 10 years with a bunch of different products (BrowserBox, DownloadNet), and ones where I didn't (WisprNote, etc). The trend was clear: giving away source led to less revenue, and more "shady" usage (big corps using but ripping it off, etc). Whereas proper "license and source protection locked-doors" led to people behaving with more respect, and more revenue.

There is an option to check the source if you’re serious about that: sign an NDA, jump on a secure data room call and I can take you through the source for audit. Normally I only do this for big customers of other products but, I’m open to it.

Thanks, bud!